Multiple denial of service (DoS) vulnerabilities have been discovered in React Server Components, affecting several widely used npm packages.
The flaws, disclosed on January 26, 2026, expose applications using React Server Components to potential server crashes, memory exhaustion, and excessive CPU consumption, prompting urgent security updates across affected versions.
Critical Vulnerability Details
Security researchers identified that previous patches addressing DoS vulnerabilities in React Server Components were incomplete, leaving applications exposed to new attack vectors.
The vulnerabilities affect three core packages: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, with exploitation requiring specially crafted HTTP requests sent to Server Function endpoints.
| CVE ID | Severity | CVSS Score | Attack Vector |
|---|---|---|---|
| CVE-2026-23864 | High | 7.5 | Network |
The attack mechanism involves malicious requests that can trigger infinite loops, causing server processes to hang and consume CPU resources indefinitely.
Even applications without implemented React Server Function endpoints remain vulnerable if they support React Server Components architecture.
| Package | Affected Versions | Patched Versions |
|---|---|---|
| react-server-dom-webpack | 19.0.0-19.0.3, 19.1.0-19.1.4, 19.2.0-19.2.3 | 19.0.4, 19.1.5, 19.2.4 |
| react-server-dom-parcel | 19.0.0-19.0.3, 19.1.0-19.1.4, 19.2.0-19.2.3 | 19.0.4, 19.1.5, 19.2.4 |
| react-server-dom-turbopack | 19.0.0-19.0.3, 19.1.0-19.1.4, 19.2.0-19.2.3 | 19.0.4, 19.1.5, 19.2.4 |
The React team has released emergency security patches to address these critical flaws.
Applications running versions 19.0.0 through 19.0.3, 19.1.0 through 19.1.4, and 19.2.0 through 19.2.3 are vulnerable and require immediate updates to patched versions 19.0.4, 19.1.5, or 19.2.4.
Affected frameworks and bundlers include Next.js, React Router, Waku, @parcel/rsc, @vite/rsc-plugin, and rwsdk.
Organizations previously updated to versions 19.0.3, 19.1.4, or 19.2.3 must apply new patches, as those releases contain incomplete fixes.
The React team recommends immediate upgrades, noting that applications not using server-side React code or React Server Components remain unaffected.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 vulnerabilities have been discovered in React Server Components, affecting several widely used npm packages.){kind=link}