Meta react-server-dom-webpack up to 19.0.3/19.1.4/19.2.3 React Server deserialization

Summaryinfo

A vulnerability was found in Meta react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel up to 19.0.3/19.1.4/19.2.3. It has been rated as critical. This vulnerability affects unknown code of the component React Server Component. This manipulation causes deserialization. This vulnerability is registered as CVE-2026-23864. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Meta react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel up to 19.0.3/19.1.4/19.2.3 and classified as critical. Affected by this vulnerability is an unknown function of the component React Server Component. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code. Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.

It is possible to read the advisory at facebook.com. This vulnerability is known as CVE-2026-23864 since 01/16/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 19.0.4, 19.1.5 or 19.2.4 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• JavaScript Library

Vendor

• Meta

Name

• react-server-dom-parcel
• react-server-dom-turbopack
• react-server-dom-webpack

Version

• 19.0.0
• 19.0.1
• 19.0.2
• 19.0.3
• 19.1.0
• 19.1.1
• 19.1.2
• 19.1.3
• 19.1.4
• 19.2.0
• 19.2.1
• 19.2.2
• 19.2.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion