CVE-2026-23870

Name of the Vulnerable Software and Affected Versions react-server-dom-webpack versions 19.0.0 through 19.0.5 react-server-dom-webpack versions 19.1.0 through 19.1.6 react-server-dom-webpack versions 19.2.0 through 19.2.5 react-server-dom-parcel versions 19.0.0 through 19.0.5 react-server-dom-parcel versions 19.1.0 through 19.1.6 react-server-dom-parcel versions 19.2.0 through 19.2.5 react-server-dom-turbopack versions 19.0.0 through 19.0.5 react-server-dom-turbopack versions 19.1.0 through 19.1.6 react-server-dom-turbopack versions 19.2.0 through 19.2.5 @vitejs/plugin-rsc versions prior to 0.5.26

Description A denial of service issue exists in React Server Components where an attacker can exhaust server resources by sending specially crafted HTTP requests to server function endpoints. This can result in server crashes, out-of-memory exceptions, or excessive CPU usage. The issue requires a specific architectural setup to be exploited and affects applications using a server and a framework, bundler, or bundler plugin that supports React Server Components.

Recommendations Update react-server-dom-webpack to version 19.0.6, 19.1.7, or 19.2.6. Update react-server-dom-parcel to version 19.0.6, 19.1.7, or 19.2.6. Update react-server-dom-turbopack to version 19.0.6, 19.1.7, or 19.2.6. Update @vitejs/plugin-rsc to version 0.5.26 or later.