{"id":10166,"date":"2026-01-27T10:03:37","date_gmt":"2026-01-27T10:03:37","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/27\/multiple-vulnerabilities-in-react-server-components-enable-dos-attacks\/"},"modified":"2026-01-27T10:03:37","modified_gmt":"2026-01-27T10:03:37","slug":"multiple-vulnerabilities-in-react-server-components-enable-dos-attacks","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/27\/multiple-vulnerabilities-in-react-server-components-enable-dos-attacks\/","title":{"rendered":"Multiple Vulnerabilities in React Server Components Enable DoS Attacks"},"content":{"rendered":"

Multiple Vulnerabilities in React Server Components Enable DoS Attacks
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Multiple critical security vulnerabilities have recently been disclosed in React Server<\/a> Components, enabling threat actors to launch Denial-of-Service (DoS) attacks against vulnerable servers.<\/p>\n

The flaws, tracked as CVE-2026-23864 with a CVSS score of 7.5, are due to incomplete patches from previous security fixes and require immediate remediation.<\/p>\n

Security researchers discovered additional attack vectors during testing the effectiveness of previous patches, demonstrating that multiple DoS <\/a>vulnerabilities persist in the framework.<\/p>\n

Vulnerability Details<\/strong><\/h2>\n

The vulnerabilities affect three npm packages<\/a> that handle React Server Components: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.<\/p>\n

Attackers can exploit these flaws by sending specially crafted HTTP requests to Server Function endpoints, triggering server crashes, out-of-memory exceptions, or excessive CPU consumption.<\/p>\n

\n\n\n\n\n\n\n\n
CVE ID<\/strong><\/th>\nCVSS Score<\/strong><\/th>\nVulnerability Type<\/strong><\/th>\nAffected Packages<\/strong><\/th>\n<\/tr>\n<\/thead>\n
CVE-2026-23864<\/strong><\/td>\n7.5<\/td>\nDenial of Service (DoS)<\/td>\nreact-server-dom-parcel<\/td>\n<\/tr>\n
CVE-2026-23864<\/strong><\/td>\n7.5<\/td>\nDenial of Service (DoS)<\/td>\nreact-server-dom-turbopack<\/td>\n<\/tr>\n
CVE-2026-23864<\/strong><\/td>\n7.5<\/td>\nDenial of Service (DoS)<\/td>\nreact-server-dom-webpack<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

The severity and impact of exploitation depend on the specific vulnerable code path being exercised, the application configuration, and the underlying application code.<\/p>\n

Organizations using React frameworks and bundlers, such as Next.js<\/a>, React Router, Waku, @parcel\/rsc, @vite\/rsc-plugin, and rwsdk, are exposed to these vulnerabilities.<\/p>\n

The disclosure follows a pattern typical in critical vulnerability management, where initial patches are scrutinized by security researchers who probe adjacent code paths for bypass techniques.<\/p>\n

This iterative process, while sometimes frustrating, represents a healthy security response cycle similar to what occurred after the Log4Shell <\/a>vulnerability.<\/p>\n

Affected Versions and Patches<\/strong><\/h2>\n
\n\n\n\n\n\n\n\n
Package Versions Affected<\/th>\nPatched Version<\/th>\n<\/tr>\n<\/thead>\n
19.0.0 \u2013 19.0.3<\/td>\n19.0.4<\/td>\n<\/tr>\n
19.1.0 \u2013 19.1.4<\/td>\n19.1.5<\/td>\n<\/tr>\n
19.2.0 \u2013 19.2.3<\/td>\n19.2.4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Applications that do not use React Server Components or server-side<\/a> React code remain unaffected by these vulnerabilities.<\/p>\n

Similarly, applications without a framework, a bundler, or a bundler plugin that supports React Server Components face no risk.<\/p>\n

\n\n\n\n\n\n
Environment<\/th>\nUpdate These Packages<\/th>\nDo NOT Update<\/th>\n<\/tr>\n<\/thead>\n
React Native (Monorepo)<\/td>\nreact-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack<\/td>\nreact, react-dom<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

According to the advisory published<\/a>, React Native users operating in monorepo environments should update :<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post Multiple Vulnerabilities in React Server Components Enable DoS Attacks<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Abinaya
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Multiple Vulnerabilities in React Server Components Enable DoS Attacks Multiple critical security vulnerabilities have recently been disclosed in React Server Components, enabling threat actors to launch Denial-of-Service (DoS) attacks against vulnerable servers. The flaws, tracked as CVE-2026-23864 with a CVSS score of 7.5, are due to incomplete patches from previous security fixes and require immediate […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,1438,648],"tags":[130],"class_list":["post-10166","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-dos-attack","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10166"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10166"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10166\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}