React Server Components Flaw Allows Single-Request Denial of Service
A high-severity vulnerability in React 19 allows attackers to freeze Next.js servers using crafted HTTP POST requests without authentication.
Key points
- CVE-2026-23870 affects React Server Components in specific React 19 releases.
- The flaw enables denial-of-service attacks via quadratic processing of form data.
- Exploitation requires no user interaction or privileged access.
Meta has disclosed a high-severity security vulnerability in React Server Components that allows attackers to cause denial-of-service conditions. The flaw, tracked as CVE-2026-23870, affects specific releases of React 19 and impacts frameworks such as Next.js.
According to GBHackers, the vulnerability arises from how React handles Server Actions during form submissions. An attacker can send a specially crafted HTTP POST request that consumes excessive CPU resources. This processing blockage can freeze servers, causing pages and APIs to stall or time out.
Technical Context
The issue stems from React’s management of Server Actions, which allow server-side function invocation. Before executing an action, React reconstructs multipart form data from the raw HTTP request. Researcher Simonkoeck identified that an attacker can exploit a $K reference type to trigger inefficient processing.
This $K reference directs React to resolve embedded or nested form data structures. For each reference, the affected code creates a complete list of all submitted form fields. The system then iterates over this full list to locate matching fields, resulting in quadratic processing overhead.
A request containing a large number of crafted references and filler fields generates millions of string comparisons. For example, a request with ten thousand $K references and ten thousand filler fields creates around 100 million checks. This payload is approximately 900 kilobytes in size.
Affected Systems
Since Node.js typically handles JavaScript request processing on a single event-loop thread, the excessive CPU workload blocks other requests. This causes significant availability impacts for any service running the vulnerable React versions. Meta assigned the flaw a CVSS score of 7.5.
The vulnerability is categorized as CWE-400, referring to uncontrolled resource consumption. It can be exploited over a network with low attack complexity. No privileges or user interaction are required to trigger the denial-of-service condition.
The deserialization process occurs before application-level authorization checks for Server Actions are executed. This timing means an attacker may not need to authenticate if an affected Server Action endpoint is accessible from a public page.
What should you do?
Security teams should audit their deployments for specific vulnerable releases of React 19. Organizations using Next.js or other frameworks relying on React Server Components are particularly at risk. Monitoring server performance for unusual CPU spikes may help detect ongoing exploitation attempts.
What to do and how to stay safe: React
- Identify all servers running vulnerable React 19 releases that support Server Actions.
- Review public-facing pages for exposed Server Action identifiers in HTML or JavaScript assets.
- Monitor server logs and CPU usage for signs of crafted HTTP POST requests causing stalls.
- Prepare to apply updates once the vendor provides a confirmed fix for CVE-2026-23870.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-23870?
Meta has assigned the vulnerability a CVSS score of 7.5, which is rated as high severity.
Does an attacker need to be logged in to exploit this flaw?
No, the vulnerability can be exploited without privileges or user interaction, especially if endpoints are public.
Which frameworks are affected by this vulnerability?
The flaw affects React Server Components packages utilized by frameworks such as Next.js in specific React 19 releases.
