CVE-2026-23869

Published Apr 8, 2026

Last updated 3 months ago

CVSS high 7.5
Tls

Overview

Description
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
Source
cve-assign@fb.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity
HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-400
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
CWE-770

Social media

Hype score
Not currently trending

Related CVEs

  1. Citrix NetScaler Improper Input Validation Vulnerability•CVE-2026-88771
  2. Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability•CVE-2026-88772
  3. F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability•CVE-2026-94127
  4. OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.•CVE-2026-81871
  5. Check Point Multiple Products Improper Certificate Validation Vulnerability•CVE-2026-85102

References

Sources include official advisories and independent security research.