CVE-2026-23869

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23869", "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "state": "PUBLISHED", "assignerShortName": "Meta", "dateReserved": "2026-01-16T19:49:26.309Z", "datePublished": "2026-04-08T19:11:08.418Z", "dateUpdated": "2026-07-15T01:17:57.169Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "react-server-dom-turbopack", "vendor": "Meta", "versions": [{"lessThanOrEqual": "19.0.4", "status": "affected", "version": "19.0.0", "versionType": "semver"}, {"lessThanOrEqual": "19.1.5", "status": "affected", "version": "19.1.0", "versionType": "semver"}, {"lessThanOrEqual": "19.2.4", "status": "affected", "version": "19.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "react-server-dom-parcel", "vendor": "Meta", "versions": [{"lessThanOrEqual": "19.0.4", "status": "affected", "version": "19.0.0", "versionType": "semver"}, {"lessThanOrEqual": "19.1.5", "status": "affected", "version": "19.1.0", "versionType": "semver"}, {"lessThanOrEqual": "19.2.4", "status": "affected", "version": "19.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "react-server-dom-webpack", "vendor": "Meta", "versions": [{"lessThanOrEqual": "19.0.4", "status": "affected", "version": "19.0.0", "versionType": "semver"}, {"lessThanOrEqual": "19.1.5", "status": "affected", "version": "19.1.0", "versionType": "semver"}, {"lessThanOrEqual": "19.2.4", "status": "affected", "version": "19.2.0", "versionType": "semver"}]}], "dateAssigned": "2026-04-08T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable."}], "problemTypes": [{"descriptions": [{"description": "(CWE-502) Deserialization of Untrusted Data, (CWE-400) Uncontrolled Resource Consumption", "lang": "en"}]}], "providerMetadata": {"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "Meta", "dateUpdated": "2026-04-08T19:11:08.418Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-502", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T19:55:33.314236Z", "id": "CVE-2026-23869", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T19:56:22.791Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-dashboard-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}], "datePublic": "2026-04-08T19:11:08.418Z", "descriptions": [{"lang": "en", "value": "A flaw was found in react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack. Specially crafted HTTP requests to server function endpoints can result in an excessive consumption of CPU resources for up to a minute, causing an error that is catchable."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-23869"}, {"name": "RHBZ#2456663", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456663"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23869.json"}], "timeline": [{"lang": "en", "time": "2026-04-08T20:01:00.803Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-08T19:11:08.418Z", "value": "Made public."}], "title": "react-server-dom-parcel: react-server-dom-turbopack: react-server-dom-webpack: denial of service via specially crafted HTTP requests to Server Function endpoints", "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:17:57.169Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "react-server-dom-parcel: react-server-dom-turbopack: react-server-dom-webpack: denial of service via specially crafted HTTP requests to Server Function endpoints", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-dashboard-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-08T20:01:00.803Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-08T19:11:08.418Z", "value": "Made public."}], "x_adpType": "supplier", "datePublic": "2026-04-08T19:11:08.418Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-23869", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456663", "name": "RHBZ#2456663", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23869.json", "tags": ["x_sadp-csaf-vex"]}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack. Specially crafted HTTP requests to server function endpoints can result in an excessive consumption of CPU resources for up to a minute, causing an error that is catchable."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:17:57.169Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23869", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T19:55:33.314236Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T19:53:45.958Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Meta", "product": "react-server-dom-turbopack", "versions": [{"status": "affected", "version": "19.0.0", "versionType": "semver", "lessThanOrEqual": "19.0.4"}, {"status": "affected", "version": "19.1.0", "versionType": "semver", "lessThanOrEqual": "19.1.5"}, {"status": "affected", "version": "19.2.0", "versionType": "semver", "lessThanOrEqual": "19.2.4"}], "defaultStatus": "unaffected"}, {"vendor": "Meta", "product": "react-server-dom-parcel", "versions": [{"status": "affected", "version": "19.0.0", "versionType": "semver", "lessThanOrEqual": "19.0.4"}, {"status": "affected", "version": "19.1.0", "versionType": "semver", "lessThanOrEqual": "19.1.5"}, {"status": "affected", "version": "19.2.0", "versionType": "semver", "lessThanOrEqual": "19.2.4"}], "defaultStatus": "unaffected"}, {"vendor": "Meta", "product": "react-server-dom-webpack", "versions": [{"status": "affected", "version": "19.0.0", "versionType": "semver", "lessThanOrEqual": "19.0.4"}, {"status": "affected", "version": "19.1.0", "versionType": "semver", "lessThanOrEqual": "19.1.5"}, {"status": "affected", "version": "19.2.0", "versionType": "semver", "lessThanOrEqual": "19.2.4"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg", "tags": ["x_refsource_CONFIRM"]}], "dateAssigned": "2026-04-08T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "(CWE-502) Deserialization of Untrusted Data, (CWE-400) Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "Meta", "dateUpdated": "2026-04-08T19:11:08.418Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23869", "state": "PUBLISHED", "dateUpdated": "2026-07-15T01:17:57.169Z", "dateReserved": "2026-01-16T19:49:26.309Z", "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "datePublished": "2026-04-08T19:11:08.418Z", "assignerShortName": "Meta"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "react-server-dom-turbopack", "vendor": "Meta", "versions": [{"lessThanOrEqual": "19.0.4", "status": "affected", "version": "19.0.0", "versionType": "semver"}, {"lessThanOrEqual": "19.1.5", "status": "affected", "version": "19.1.0", "versionType": "semver"}, {"lessThanOrEqual": "19.2.4", "status": "affected", "version": "19.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "react-server-dom-parcel", "vendor": "Meta", "versions": [{"lessThanOrEqual": "19.0.4", "status": "affected", "version": "19.0.0", "versionType": "semver"}, {"lessThanOrEqual": "19.1.5", "status": "affected", "version": "19.1.0", "versionType": "semver"}, {"lessThanOrEqual": "19.2.4", "status": "affected", "version": "19.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "react-server-dom-webpack", "vendor": "Meta", "versions": [{"lessThanOrEqual": "19.0.4", "status": "affected", "version": "19.0.0", "versionType": "semver"}, {"lessThanOrEqual": "19.1.5", "status": "affected", "version": "19.1.0", "versionType": "semver"}, {"lessThanOrEqual": "19.2.4", "status": "affected", "version": "19.2.0", "versionType": "semver"}]}], "source": "cve-assign@fb.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-dashboard-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable."}, {"lang": "es", "value": "Una vulnerabilidad de denegaci\u00f3n de servicio existe en los Componentes de Servidor de React, que afecta a los siguientes paquetes: react-server-dom-parcel, react-server-dom-turbopack y react-server-dom-webpack (versiones 19.0.0 a 19.0.4, 19.1.0 a 19.1.5, y 19.2.0 a 19.2.4). La vulnerabilidad se activa al enviar solicitudes HTTP especialmente dise\u00f1adas a los puntos finales de la Funci\u00f3n de Servidor. La carga \u00fatil de la solicitud HTTP causa un uso excesivo de la CPU durante hasta un minuto, terminando en un error lanzado que es capturable."}], "id": "CVE-2026-23869", "lastModified": "2026-07-25T11:10:00.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "cve-assign@fb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23869", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T19:55:33.314236Z", "version": "2.0.3"}}]}, "published": "2026-04-08T20:16:23.003", "references": [{"source": "cve-assign@fb.com", "url": "https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-23869"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456663"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23869.json"}], "sourceIdentifier": "cve-assign@fb.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-502"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-770"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "react-server-dom-parcel: react-server-dom-turbopack: react-server-dom-webpack: denial of service via specially crafted HTTP requests to Server Function endpoints", "id": "2456663", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456663"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack. Specially crafted HTTP requests to server function endpoints can result in an excessive consumption of CPU resources for up to a minute, causing an error that is catchable."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible"}, "name": "CVE-2026-23869", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-dashboard-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-04-08T19:11:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23869\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23869\nhttps://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg"], "statement": "Applications are not vulnerable to this issue if they do not use a server, or if they do not use a framework, bundler, or plugin that supports React server components.\nThis vulnerability allows an unauthenticated remote attacker to cause a denial of service. Due to these reasons, this flaw has been rated with an important severity.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[19.0.0,19.0.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[19.1.0,19.1.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[19.2.0,19.2.4]"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "react-server-dom-parcel", "source": "cna", "vendor": "Meta"}, "product": "react-server-dom-parcel", "vendor": "facebook"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[19.0.0,19.0.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[19.1.0,19.1.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[19.2.0,19.2.4]"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "react-server-dom-turbopack", "source": "cna", "vendor": "Meta"}, "product": "react-server-dom-turbopack", "vendor": "facebook"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[19.0.0,19.0.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[19.1.0,19.1.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[19.2.0,19.2.4]"}}], "enrichment": {"confidence": 84.0, "confidence_source": "matching", "scores": [{"score": 84.0, "source": "matching"}]}, "original": {"product": "react-server-dom-webpack", "source": "cna", "vendor": "Meta"}, "product": "react-server-dom-webpack", "vendor": "facebook"}], "analysis": {"en": {"generated_at": "2026-04-11T01:21:51.681551+00:00", "value": {"mitigation_remediation": ["Determine the current versions of react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack in your codebase.", "Upgrade each package to a version outside the affected ranges (for example, 19.0.5 or later for react-server-dom-parcel, 19.1.6 or later for react-server-dom-turbopack, and 19.2.5 or later for react-server-dom-webpack) or to the latest release available.", "Verify the upgraded packages by running unit tests and functional tests in a staging environment before deploying to production.", "Deploy the updated packages to production once testing is successful.", "Monitor CPU usage and logs after deployment to confirm that the denial\u2011of\u2011service behavior no longer occurs."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Meta's React Server Components packages: react-server-dom-parcel versions 19.0.0 through 19.0.4, react-server-dom-turbopack versions 19.1.0 through 19.1.5, and react-server-dom-webpack versions 19.2.0 through 19.2.4.", "description_and_impact": "A vulnerability in React Server Components allows attackers to trigger excessive CPU consumption by sending crafted HTTP requests to Server Function endpoints. The request payload forces the server to perform intensive processing for up to a minute before raising a catchable error, which can render the application unresponsive. This resource exhaustion leads to a denial of service for users of the affected application.", "risk_and_exploitability": "The CVSS score of 7.5 rates this vulnerability as high severity. However, the EPSS score is below 1\u202f% and the issue is not listed in the CISA KEV catalog, suggesting a low probability of widespread exploitation. The attack vector is network\u2011based; an attacker can send the crafted request over HTTP directly to the server function endpoint, causing the target server to consume excessive CPU resources. Because the error thrown is catchable, the application may recover, but the temporary denial of service can impact user experience and system stability."}}}}, "created": "2026-04-09T08:18:22.062174+00:00", "updated": "2026-04-13T14:25:06.123222+00:00", "vendors": ["facebook", "facebook$PRODUCT$react-server-dom-parcel", "facebook$PRODUCT$react-server-dom-turbopack", "facebook$PRODUCT$react-server-dom-webpack"]}