A high-severity vulnerability (CVE-2026-23870, CVSS 7.5) in React Server Components lets attackers freeze Next.js servers with a single crafted POST request — no authentication needed.
The flaw lives in how React rebuilds form data before running a Server Action. A request with 10 000 references and 10 000 form fields triggers roughly 100 million string comparisons, choking the CPU and blocking Node.js’s event loop. Researcher Simon Koeck showed that a request of around 900 KB is enough to trigger that workload, and the article notes legitimate users can end up with slow loads, timeouts, or 503s.
Because the parsing happens before your Server Action’s own code runs, checks written inside the action won’t help. Public endpoints are the most exposed, but any logged-in user who can reach a Server Action is enough.
React patched versions 19.0.0–19.0.5, 19.1.0–19.1.6, and 19.2.0–19.2.5 in releases 19.0.6, 19.1.7, and 19.2.6. Check your resolved dependency tree rather than your top-level Next.js version — the affected packages are react-server-dom-webpack, react-server-dom-turbopack, and react-server-dom-parcel, and they arrive through framework dependencies. Proxy body-size limits and rate controls cut exposure, but patching React is the actual fix.
Source: Cybersecurity News
