CVE-2026-23864
Published: 26 January 2026
Summary
CVE-2026-23864 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Facebook React. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
Multiple denial of service vulnerabilities exist in React Server Components, affecting the packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The issues are tracked under CWE-400 and CWE-502 with a CVSS 3.1 score of 7.5 and are triggered by specially crafted HTTP requests to Server Function endpoints, which can produce server crashes, out-of-memory conditions, or excessive CPU usage depending on the exercised code path, application configuration, and surrounding code.
An unauthenticated remote attacker can send malicious requests to the exposed endpoints and thereby disrupt availability of any application relying on the vulnerable React Server Components packages.
The referenced Facebook security advisory states that organizations should strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues.
The associated EPSS score remains flat at 0.0198 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4673
Vulnerability details
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or…
more
excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code. Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in exposed React Server Function endpoints allows remote unauthenticated exploitation (T1190) via crafted HTTP requests that trigger resource exhaustion or crashes (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely flaw remediation through upgrading vulnerable React Server Components packages, directly preventing exploitation of the DoS vulnerabilities.
Implements denial-of-service protections at system boundaries to block specially crafted HTTP requests targeting Server Function endpoints.
Validates information inputs to Server Function endpoints, preventing processing of malformed requests that cause server crashes, OOM, or excessive CPU usage.