New React Server Components Flaw Could Let Attackers Trigger DoS

A newly disclosed high-severity vulnerability in React Server Components could allow unauthenticated attackers to trigger a Denial of Service (DoS) condition.

Tracked as CVE-2026-23869, this flaw poses a significant risk to web applications using specific server-side rendering packages.

Because the exploit requires no privileges and involves low attack complexity, threat actors can easily target vulnerable servers over the network to disrupt business operations.

Understanding the Exploit

The vulnerability is categorised as an Uncontrolled Resource Consumption issue (CWE-400) and is also linked to insecure deserialization practices (CWE-502).

Threat actors can trigger the flaw by sending specially crafted HTTP requests directly to React Server Function endpoints.

When a vulnerable server receives this malicious payload, it attempts to process the request, leading to massive CPU spikes.

A single request can force excessive CPU usage for up to an entire minute before eventually throwing a catchable error. If an attacker sends a continuous stream of these crafted requests, the server’s processing power will rapidly deplete.

This resource exhaustion leaves the application unable to handle legitimate user traffic, resulting in application downtime and a completely disrupted user experience.

This vulnerability specifically targets the server-side document object model (DOM) packages used by popular web bundlers.

If your application relies on React Server Components, you must check your project dependencies for the following npm packages:

• react-server-dom-parcel
• react-server-dom-turbopack
• react-server-dom-webpack

For all three of these packages, the vulnerability exists across three active release lines:

• Versions 19.0.0 through 19.0.4
• Versions 19.1.0 through 19.1.5
• Versions 19.2.0 through 19.2.4

The React development team has successfully backported security fixes to resolve the uncontrolled resource consumption flaw.

To protect your infrastructure from potential DoS attacks, administrators must immediately upgrade the affected npm packages to the following patched versions:

• Update to version 19.0.5
• Update to version 19.1.6
• Update to version 19.2.5

It is important to note that not all React applications are at risk. The vulnerability is strictly isolated to environments running React Server Components.

If your React application operates entirely on the client side without a server, you are not affected. Similarly, if your application does not use a framework, bundler, or bundler plugin designed to support React Server Components, you can safely ignore this alert.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.