React Server Components Hit by High-Severity DoS Vulnerability — Update Immediately
A high-severity denial-of-service (DoS) vulnerability, tracked as CVE-2026-23869 (CVSS score: 7.5), has been publicly disclosed affecting React Server Components (RSCs) and all major frameworks that rely on them — most notably Next.js. The vulnerability was published on April 8, 2026, and patches are now available.
What Is the Vulnerability?
The flaw exists in the React Server Components deserialization layer. A specially crafted HTTP request sent to any App Router Server Function endpoint can trigger excessive CPU consumption when deserialized, resulting in a denial-of-service condition. The attack requires no authentication and no user interaction, making it particularly dangerous for publicly exposed applications.
The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected Versions
React (react-server-dom packages):
- 19.0.0 to 19.0.4 – Fixed in 19.0.5
- 19.1.0 to 19.1.5 – Fixed in 19.1.6
- 19.2.0 to 19.2.4 – Fixed in 19.2.5
Next.js:
- 13.3.0+ – EOL, no fix planned. Upgrade to 15.x or 16.x.
- 14.x – EOL, no fix planned. Upgrade to 15.x or 16.x.
- 15.0.0 to 15.5.14 – Fixed in 15.5.15
- 16.0.0 to 16.2.2 – Fixed in 16.2.3
Other Affected Frameworks
Beyond Next.js, the following RSC-based frameworks are also affected: React Router 7 (if using RSC preview), Waku, @parcel/rsc, and @vitejs/plugin-rsc. Notably, Astro, Gatsby, and Remix are NOT affected.
What Should You Do?
- Upgrade immediately to a patched version of Next.js (15.5.15 or 16.2.3) and React (19.0.5, 19.1.6, or 19.2.5).
- If you are on Next.js 13.x or 14.x, no patch will be issued – you must migrate to a supported version.
- Vercel has deployed WAF rules to automatically protect hosted projects, but this should not be relied upon as a sole mitigation.
- Netlify notes minimal impact due to its autoscaling serverless architecture, but warns that active exploitation could increase function costs.
- Review and manually delete any vulnerable deploy previews or branch deploys.
Severity at a Glance
- CVE ID: CVE-2026-23869
- CVSS Score: 7.5 (High)
- Attack Vector: Network (no auth required)
- Impact: Availability (Denial of Service)
- Weakness: CWE-770
Key Takeaway: If your application uses Next.js with the App Router or any RSC-enabled framework, this vulnerability directly affects you. Patch immediately – the attack requires no authentication and can be triggered remotely by anyone.
Hashtags: #ReactJS #NextJS #Security #CVE #WebDevelopment #AppSecurity #DeveloperAlert #RSC #ReactServerComponents
Sources and Resources: