{"id":"EUVD-2026-27867","enisaUuid":"109c265e-8fd3-3959-bb19-7985ed67de72","description":"A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).","datePublished":"May 6, 2026, 4:24:55 PM","dateUpdated":"May 6, 2026, 7:06:00 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh\n","aliases":"CVE-2026-23870\n","assigner":"Meta","epss":1.53,"enisaIdProduct":[{"id":"2bfc5ea8-6b12-39fc-8969-9891ef0b5278","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.6"},{"id":"57fbe977-6f75-36bc-812e-7e2c35ab2b45","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.5"},{"id":"7cdc5781-d180-3a5e-a96d-bf1e2be6de95","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.5"},{"id":"8e2b321f-20b7-3df4-8980-5150d5e0f600","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.5"},{"id":"96c0b3ae-238b-38c2-b6f6-638437d4d42d","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.5"},{"id":"a794c5a7-2749-3c83-a5a1-e9112addec44","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.5"},{"id":"abd22088-964b-3d74-97a9-c23337b7d8da","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.5"},{"id":"b05e7e5f-ace4-35d2-be13-98c5468d7ecb","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.6"},{"id":"d0609b15-cfaf-3b48-8883-ef5733909a19","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.6"}],"enisaIdVendor":[{"id":"35ff7d8a-6ed9-34ac-a8c4-1dcf3cc96c7f","vendor":{"name":"Meta"}}],"enisaIdVulnerability":[{"id":"f92202b7-01f9-30d2-8ec1-35aba1affeae","vulnerability":{"id":"GHSA-rv78-f8rc-xrxh","description":"Facebook React has a Denial of Service Vulnerability in React Server Components","datePublished":"May 11, 2026, 2:50:07 PM","dateUpdated":"May 11, 2026, 2:50:07 PM","baseScore":0.0,"references":"https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh\nhttps://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj\nhttps://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-w94c-4vhp-22gx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23870\nhttps://github.com/facebook/react\n","enisa_id":"EUVD-2026-27867\n","aliases":"GHSA-rv78-f8rc-xrxh\nCVE-2026-23870\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fbf14f43-f964-31af-bada-9454eb08d9a2","vulnerability":{"id":"CVE-2026-23870","description":"A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).","datePublished":"May 6, 2026, 4:24:55 PM","dateUpdated":"May 6, 2026, 7:06:00 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh\n","enisa_id":"EUVD-2026-27867\n","assigner":"Meta","epss":1.53,"dataProcessed":"Nov 7, 2026, 7:22:59 AM","vulnerabilityProduct":[{"id":"0806a481-1d92-3aef-9b44-01efa9430ce9","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.6"},{"id":"091445ec-9291-33f0-8ec7-352be1ce3cdf","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.6"},{"id":"35696c29-cbe6-3fac-a554-8cad4384a847","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.5"},{"id":"4d3d73ed-987a-3eaa-9e2a-e5692f4c8a1a","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.5"},{"id":"6e94141b-d90e-355e-b0fc-e86378df2f93","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.5"},{"id":"85241b87-d654-3fd5-a734-873a6bcd5ba0","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.6"},{"id":"b2634c09-c977-3c0e-b206-1c6f39b54df1","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.5"},{"id":"bf6d081e-34fb-34f4-95d0-0ebd7c6bdb13","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.5"},{"id":"d1af2d73-a56a-30b2-8df9-bfcb704cbb3b","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.5"}],"vulnerabilityVendor":[{"id":"755084e0-dcc5-3b92-b418-8b592b8a75f4","vendor":{"name":"Meta"}}]}}],"enisaIdAdvisory":[{"id":"dc65548c-aa2c-3bea-9401-ae14c7b07e97","advisory":{"id":"WID-SEC-W-2026-1401","description":"Vercel Next.js: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.","datePublished":"May 6, 2026, 10:00:00 PM","dateUpdated":"May 13, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1401.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-1401\n","aliases":"CVE-2026-23870\nCVE-2026-44572\nCVE-2026-44573\nCVE-2026-44574\nCVE-2026-44575\nCVE-2026-44576\nCVE-2026-44577\nCVE-2026-44578\nCVE-2026-44579\nCVE-2026-44580\nCVE-2026-44581\nCVE-2026-44582\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"4e34fb10-e5d0-3e4b-8497-b7a28d0c5bdf","product":{"name":"next.js","vendor":{"name":"vercel"}}},{"id":"6eef55a1-eced-366b-8ed5-72c112ffd47b","product":{"name":"15.5.16","vendor":{"name":"vercel"}}},{"id":"83bd8c68-9fd8-3c45-b4fe-706987676131","product":{"name":"16.2.5","vendor":{"name":"vercel"}}}]}}]}