UpHeron
All vulnerabilities

npm

CVE-2026-23870

Facebook React has a Denial of Service Vulnerability in React Server Components

Severity
High 7.5
Published
11 May 2026
Last changed
11 May 2026
Added to UpHeron
22 Oct 2026
Fixed in
19.0.6, 19.1.7, 19.2.6
Also known as
GHSA-rv78-f8rc-xrxh
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
react-server-dom-parcelnpm · osv:npm:react-server-dom-parcel
  • From 19.0.0 before 19.0.6
  • From 19.1.0 before 19.1.7
  • From 19.2.0 before 19.2.6
react-server-dom-turbopacknpm · osv:npm:react-server-dom-turbopack
  • From 19.0.0 before 19.0.6
  • From 19.1.0 before 19.1.7
  • From 19.2.0 before 19.2.6
Reactnpm · osv:npm:react-server-dom-webpack
  • From 19.0.0 before 19.0.6
  • From 19.1.0 before 19.1.7
  • From 19.2.0 before 19.2.6

References