High-severity DoS in React Server Components (CVE-2026-23864) with incomplete prior fixes
React maintainers disclosed that earlier mitigations for denial-of-service issues in React Server Components were incomplete, leaving multiple DoS conditions still exploitable as CVE-2026-23864 (CVSS 7.5). The issue affects the react-server-dom-* packages used by bundlers—react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack—across versions 19.0.0–19.2.3. An attacker can send specially crafted HTTP requests to Server Function endpoints to drive resource exhaustion, potentially causing server crashes, out-of-memory conditions, or excessive CPU usage; applications that do not use a server-side React Server Components/Server Functions setup (e.g., purely client-side SPAs) are not impacted.
Vercel reported the vulnerabilities were responsibly disclosed and emphasized they do not enable RCE, but can still materially impact availability for affected deployments, including those using Next.js and other frameworks/bundlers that embed React Server Components. Vercel deployed new WAF rules to provide automatic mitigation for projects hosted on its platform, while warning that WAF protections are not a substitute for patching. Recommended remediation is to upgrade to patched releases: React 19.0.4, 19.1.5, 19.2.4, and updated downstream framework versions (including multiple Next.js fixed releases) as provided by maintainers.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Vercel deploys WAF mitigations for all hosted projects
Vercel created and deployed new mitigation rules to the Vercel WAF to automatically protect all Vercel-hosted projects at no additional cost. The company emphasized that WAF protection alone was not sufficient and that customers should still upgrade to patched React and framework releases.
Next.js publishes fixes across supported branches
Downstream framework fixes were released for Next.js across multiple supported branches and canary versions to address the React Server Components denial-of-service issue. Users were advised to update framework versions in addition to relying on upstream React patches.
React issues advisory for CVE-2026-23864 and releases patched versions
React disclosed CVE-2026-23864, warning that earlier fixes were incomplete and that affected server-dom packages remained vulnerable across versions 19.0.0 through 19.2.3. The project released patched versions 19.0.4, 19.1.5, and 19.2.4 and urged developers to upgrade immediately.
Researchers responsibly disclose React Server Components DoS flaws
Multiple researchers from Winfunc Research, GMO Flatt Security, and Tencent Security YUNDING LAB responsibly disclosed high-severity denial-of-service vulnerabilities affecting React Server Components and Server Function endpoints. The flaws could be triggered with specially crafted HTTP requests to cause crashes, out-of-memory conditions, or excessive CPU usage, but were explicitly stated not to enable remote code execution.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
Multiple Vulnerabilities in React Server Components Enable DoS Attacks
cybersecuritynews.com
Open sourceIncomplete Fix: High-Severity React Server Components DoS Flaw (CVE-2026-23864)
securityonline.info
Open sourceSummary of CVE-2026-23864 - Vercel
vercel.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Critical Unauthenticated RCE Vulnerabilities in React Server Components and Next.js
A critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2025-55182, has been discovered in React Server Components, affecting core React packages (`react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack`) in versions 19.0, 19.1.0, 19.1.1, and 19.2.0. The flaw arises from unsafe deserialization of payloads sent to React Server Function endpoints, allowing attackers to execute arbitrary code on the server without authentication. This vulnerability also impacts frameworks and bundlers that integrate React Server Components, including Next.js (assigned CVE-2025-66478), Vite, Parcel, React Router, RedwoodSDK, and Waku. Even default configurations and newly generated Next.js applications are vulnerable, and exploitation requires only a crafted HTTP request, with no developer error or special setup needed. Immediate patching is strongly advised, as the vulnerability is rated CVSS 10.0 (critical) and has been shown to be highly reliable in exploitation tests. Patched versions are available for React (19.0.1, 19.1.2, 19.2.1) and Next.js (15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7), and users are urged to upgrade all affected packages and dependencies. Some hosting providers, such as Vercel, have implemented temporary platform-level mitigations, but these are not a substitute for patching. Security researchers estimate that up to 39% of cloud environments may contain vulnerable instances, underscoring the urgency of remediation across the React and Next.js ecosystem.
Mar 21, 2026
Denial-of-Service and Source Code Exposure Vulnerabilities in React Server Components
Security researchers have identified three new vulnerabilities in React Server Components (RSC) following the recent patch for the critical React2Shell exploit. These flaws include two high-severity Denial-of-Service (DoS) vulnerabilities (CVE-2025-55184 and CVE-2025-67779) and a medium-severity Source Code Exposure vulnerability (CVE-2025-55183). The DoS vulnerabilities allow attackers to send malicious HTTP requests to Server Function endpoints, triggering infinite loops that hang the server and exhaust CPU resources, effectively taking applications offline. The source code exposure flaw enables attackers to craft HTTP requests that can leak the source code of server functions, potentially exposing hardcoded secrets or sensitive logic, though runtime secrets remain protected. The affected packages are `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack`, impacting React versions 19.0.0 through 19.2.2 and frameworks such as Next.js, Waku, and React Router. Initial patches released for these vulnerabilities were incomplete, necessitating immediate upgrades to versions 19.0.3, 19.1.4, and 19.2.3 to ensure full protection. The vulnerabilities were discovered by security researchers during attempts to bypass previous mitigations, highlighting the importance of rapid patch adoption and ongoing scrutiny of critical code paths after major disclosures. Users are strongly advised to update affected packages and monitor official channels for further security updates.
Mar 21, 2026Denial-of-Service and Source Code Exposure Vulnerabilities in React Server Components
Multiple vulnerabilities have been identified in React Server Components (RSC), specifically CVE-2025-55183, CVE-2025-55184, and CVE-2025-67779, affecting several versions of `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack`. These vulnerabilities, discovered following the React2Shell incident, include a high-severity denial-of-service (DoS) flaw (CVE-2025-55184) caused by unsafe deserialization of structured input in the RSC Flight protocol, which can be exploited by sending specially crafted requests that trigger infinite loops or event-loop lockups on the server. The vulnerabilities also raise concerns about potential source code exposure and highlight the risk of residual flaws being discovered after major disclosures. The React Foundation has issued advisories and patches for affected versions, and the Canadian Centre for Cyber Security has urged administrators to update impacted libraries and frameworks, including popular tools such as Next.js, Vite RSC plugin, Parcel RSC plugin, React Router RSC preview, RedwoodSDK, and Waku. No public exploits are currently available, but the vulnerabilities have a higher-than-average likelihood of exploitation, emphasizing the importance of prompt remediation and ongoing vigilance for follow-on issues after initial vulnerability disclosures.
Mar 21, 2026