React Server Components Flaw Lets Attackers Freeze Next.js Servers With a Single POST Request

Cybersecuritynews •Abinaya • October 9, 2026

A high-severity denial-of-service flaw (CVE-2026-23870) in React Server Components can allow a remote attacker to freeze vulnerable .js servers by sending a specially crafted POST request to a Server Function endpoint. The issue has a CVSS score of 7.5 and affects React Server Components packages used by React 19.x applications, including many .js deployments using […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

React Server Components Vulnerability Allows DoS Attacks on Next.js Servers A high-severity vulnerability (CVE-2026-23870) in React Server Components enables attackers to freeze Next.js servers by sending specially crafted HTTP POST requests. This flaw affects React 19.x versions and can lead to denial-of-service conditions due to excessive CPU consumption. The vulnerability arises from the handling of multipart form data during server-side function invocations, resulting in quadratic processing overhead. Attackers can exploit this vulnerability without requiring authentication if the Server Action endpoint is publicly accessible. The affected packages include react-server-dom-webpack, react-server-dom-turbopack, and react-server-dom-parcel, specifically in versions 19.0.0 to 19.2.5. Organizations using these components are advised to implement mitigations immediately. 2 sources 63

Extracted Entities

React Server Components Flaw Lets Attackers Freeze Next.js Servers With a Single POST Request

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)