CVE-2026-23870: Facebook React has a Denial of Service Vulnerability in React Server Components

May 11, 2026

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.

We recommend updating immediately.

The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of:

react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack

References

github.com/advisories/GHSA-rv78-f8rc-xrxh
github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh
github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj
github.com/vitejs/vite-plugin-react/security/advisories/GHSA-w94c-4vhp-22gx
nvd.nist.gov/vuln/detail/CVE-2026-23870

Code Behaviors & Features

Detect and mitigate CVE-2026-23870 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →