{"id":"CVE-2026-23870","revision":"d0352b9439334f5795a1d774b367a0fc","records":[{"revision":"d0352b9439334f5795a1d774b367a0fc","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-23870","aliases":[],"title":"A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packag…","description":"A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).","state":0,"publishedAt":"2026-05-06T16:24:55.62+00:00","modifiedAt":"2026-05-06T19:06:00.435+00:00","affected":[{"ecosystem":"Vendor product","name":"react-server-dom-turbopack","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"react-server-dom-turbopack\",\n                    \"vendor\": \"Meta\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"19.0.5\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.0.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"19.1.6\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.1.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"19.2.5\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.2.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"react-server-dom-parcel","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"react-server-dom-parcel\",\n                    \"vendor\": \"Meta\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"19.0.5\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.0.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"19.1.6\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.1.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"19.2.5\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.2.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"react-server-dom-webpack","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"react-server-dom-webpack\",\n                    \"vendor\": \"Meta\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"19.0.5\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.0.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"19.1.6\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.1.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"19.2.5\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.2.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23870","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-23870","identifiers":["CVE-2026-23870"]},"retained":false,"historicalAffected":[]}],"coverage":[]}