CVE-2026-23864

score

<0.1

cvss

7.5

epss

2.6%

published

2026-01-26

kev added

—

first seen

2026-10-21

React Server Components in react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain denial of service vulnerabilities caused by specially crafted HTTP requests to Server Function endpoints, letting attackers cause server crashes or resource exhaustion, exploit requires sending crafted requests.