CVE-2026-23870

CVSS 7.5 HIGHEPSS 1.5%

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Productos afectados

Meta · react-server-dom-parcel Meta · react-server-dom-turbopack Meta · react-server-dom-webpack

PoCs públicas encontradas — 2

githubgithub.com/dwisiswant0/next-16.2.4-pocs★ 168 githubgithub.com/emresandikci/nextjs-cve-2026-23870-checker★ 0

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh