Read the docs
TI-2026-19229 Aliases CVE-2026-23869GHSA-479c-33wc-g2pg

Uncontrolled resource consumption in Meta react-server-dom-turbopack

Priority MEDIUM 42CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service, Code execution
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400 and CWE-502.

Summary

A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01575 75th percentileScored 2026-11-07
Fix Fixed react-server-dom-parcel (npm): 19.0.5, 19.1.6, 19.2.5react-server-dom-turbopack (npm): 19.0.5, 19.1.6, 19.2.5+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Metareact-server-dom-turbopack19.0.0 – 19.0.4; 19.1.0 – 19.1.5; 19.2.0 – 19.2.4—No fix listedCNA
Metareact-server-dom-parcel19.0.0 – 19.0.4; 19.1.0 – 19.1.5; 19.2.0 – 19.2.4—No fix listedCNA
Metareact-server-dom-webpack19.0.0 – 19.0.4; 19.1.0 – 19.1.5; 19.2.0 – 19.2.4—No fix listedCNA
—react-server-dom-parcel (npm)19.0.0 to before 19.0.519.0.5Patch availableGHSA-479c-33wc-g2pg
—react-server-dom-parcel (npm)19.1.0 to before 19.1.619.1.6Patch availableGHSA-479c-33wc-g2pg
—react-server-dom-parcel (npm)19.2.0 to before 19.2.519.2.5Patch availableGHSA-479c-33wc-g2pg
—react-server-dom-turbopack (npm)19.0.0 to before 19.0.519.0.5Patch availableGHSA-479c-33wc-g2pg
—react-server-dom-turbopack (npm)19.1.0 to before 19.1.619.1.6Patch availableGHSA-479c-33wc-g2pg
—react-server-dom-turbopack (npm)19.2.0 to before 19.2.519.2.5Patch availableGHSA-479c-33wc-g2pg
—react-server-dom-webpack (npm)19.0.0 to before 19.0.519.0.5Patch availableGHSA-479c-33wc-g2pg
—react-server-dom-webpack (npm)19.1.0 to before 19.1.619.1.6Patch availableGHSA-479c-33wc-g2pg
—react-server-dom-webpack (npm)19.2.0 to before 19.2.519.2.5Patch availableGHSA-479c-33wc-g2pg
  • react-server-dom-turbopack VendorMeta Affected 19.0.0 – 19.0.4; 19.1.0 – 19.1.5; 19.2.0 – 19.2.4 Fixed in — No fix listed CNA
  • react-server-dom-parcel VendorMeta Affected 19.0.0 – 19.0.4; 19.1.0 – 19.1.5; 19.2.0 – 19.2.4 Fixed in — No fix listed CNA
  • react-server-dom-webpack VendorMeta Affected 19.0.0 – 19.0.4; 19.1.0 – 19.1.5; 19.2.0 – 19.2.4 Fixed in — No fix listed CNA
  • react-server-dom-parcel (npm) Vendor— Affected 19.0.0 to before 19.0.5 Fixed in 19.0.5 Patch available GHSA-479c-33wc-g2pg
  • react-server-dom-parcel (npm) Vendor— Affected 19.1.0 to before 19.1.6 Fixed in 19.1.6 Patch available GHSA-479c-33wc-g2pg
  • react-server-dom-parcel (npm) Vendor— Affected 19.2.0 to before 19.2.5 Fixed in 19.2.5 Patch available GHSA-479c-33wc-g2pg
  • react-server-dom-turbopack (npm) Vendor— Affected 19.0.0 to before 19.0.5 Fixed in 19.0.5 Patch available GHSA-479c-33wc-g2pg
  • react-server-dom-turbopack (npm) Vendor— Affected 19.1.0 to before 19.1.6 Fixed in 19.1.6 Patch available GHSA-479c-33wc-g2pg
  • react-server-dom-turbopack (npm) Vendor— Affected 19.2.0 to before 19.2.5 Fixed in 19.2.5 Patch available GHSA-479c-33wc-g2pg
  • react-server-dom-webpack (npm) Vendor— Affected 19.0.0 to before 19.0.5 Fixed in 19.0.5 Patch available GHSA-479c-33wc-g2pg
  • react-server-dom-webpack (npm) Vendor— Affected 19.1.0 to before 19.1.6 Fixed in 19.1.6 Patch available GHSA-479c-33wc-g2pg
  • react-server-dom-webpack (npm) Vendor— Affected 19.2.0 to before 19.2.5 Fixed in 19.2.5 Patch available GHSA-479c-33wc-g2pg

Remediation

  • Fix · GHSA-479c-33wc-g2pg react-server-dom-parcel (npm) Fixed in 19.0.5 Advisory →
  • Fix · GHSA-479c-33wc-g2pg react-server-dom-parcel (npm) Fixed in 19.1.6 Advisory →
  • Fix · GHSA-479c-33wc-g2pg react-server-dom-parcel (npm) Fixed in 19.2.5 Advisory →
  • Fix · GHSA-479c-33wc-g2pg react-server-dom-turbopack (npm) Fixed in 19.0.5 Advisory →
  • Fix · GHSA-479c-33wc-g2pg react-server-dom-turbopack (npm) Fixed in 19.1.6 Advisory →
  • Fix · GHSA-479c-33wc-g2pg react-server-dom-turbopack (npm) Fixed in 19.2.5 Advisory →
  • Fix · GHSA-479c-33wc-g2pg react-server-dom-webpack (npm) Fixed in 19.0.5 Advisory →
  • Fix · GHSA-479c-33wc-g2pg react-server-dom-webpack (npm) Fixed in 19.1.6 Advisory →
  • Fix · GHSA-479c-33wc-g2pg react-server-dom-webpack (npm) Fixed in 19.2.5 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23869
  2. 2026-10-03 Alias added: GHSA-479c-33wc-g2pg

References

Advisory 1

Other 3

  • TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-02633 Heap-based buffer overflow in Meta WhatsApp for Android KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-13416 Cross-site scripting in Meta WhatsApp Desktop KEVCVSS 3.1HIGH 8.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2025-34857 Incorrect authorization in Meta WhatsApp Desktop for Mac KEVCVSS 3.1MEDIUM 5.4
  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
See all 191 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences