CVE-2026-23864

HighRCE

Published: 26 January 2026

Published

26 January 2026

Modified

13 February 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0111 78.2th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-23864 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Facebook React. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Requires timely flaw remediation through upgrading vulnerable React Server Components packages, directly preventing exploitation of the DoS vulnerabilities.

SC-5 Denial-of-service Protection good match

prevent

Implements denial-of-service protections at system boundaries to block specially crafted HTTP requests targeting Server Function endpoints.

SI-10 Information Input Validation good match

prevent

Validates information inputs to Server Function endpoints, preventing processing of malformed requests that cause server crashes, OOM, or excessive CPU usage.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Vulnerability in exposed React Server Function endpoints allows remote unauthenticated exploitation (T1190) via crafted HTTP requests that trigger resource exhaustion or crashes (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or…

excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code. Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.

Deeper analysisAI

Multiple denial of service vulnerabilities, identified as CVE-2026-23864, affect React Server Components in the packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. These flaws, published on 2026-01-26 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), are linked to CWE-400 (Uncontrolled Resource Consumption) and CWE-502 (Deserialization of Untrusted Data). The issues arise from processing malformed inputs in Server Function endpoints, potentially causing server crashes, out-of-memory exceptions, or excessive CPU usage based on the specific code path, application configuration, and custom code.

Attackers can exploit these vulnerabilities remotely over the network with low complexity and no required privileges or user interaction. By sending specially crafted HTTP requests to exposed Server Function endpoints, unauthenticated attackers can trigger resource exhaustion, leading to denial of service through application unavailability.

The advisory from Facebook recommends strongly considering upgrades to the latest versions of the affected packages to mitigate risk and prevent availability issues in applications using React Server Components. Additional details are available at https://www.facebook.com/security/advisories/cve-2026-23864.