UpHeron
All vulnerabilities

npm

CVE-2026-23869

React Server Components have a Denial of Service Vulnerability

Severity
High 7.5
Published
10 Apr 2026
Last changed
10 Apr 2026
Added to UpHeron
22 Oct 2026
Fixed in
19.0.5, 19.1.6, 19.2.5
Also known as
GHSA-479c-33wc-g2pg
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
react-server-dom-parcelnpm · osv:npm:react-server-dom-parcel
  • From 19.0.0 before 19.0.5
  • From 19.1.0 before 19.1.6
  • From 19.2.0 before 19.2.5
react-server-dom-turbopacknpm · osv:npm:react-server-dom-turbopack
  • From 19.0.0 before 19.0.5
  • From 19.1.0 before 19.1.6
  • From 19.2.0 before 19.2.5
Reactnpm · osv:npm:react-server-dom-webpack
  • From 19.0.0 before 19.0.5
  • From 19.1.0 before 19.1.6
  • From 19.2.0 before 19.2.5

References