React Server Components Flaw Lets Attackers Freeze Next.js Servers With a Single POST Request

What happened?

A high-severity denial-of-service flaw (CVE-2026-23870) in React Server Components can allow a remote attacker to freeze vulnerable Next.js servers by sending a specially crafted POST request to a Server Function endpoint. The issue has a CVSS score of 7.5 and affects React Server Components packages used by React 19.x applications, including many Next.js deployments using Server Actions. The vulnerability stems from the way React rebuilds submitted form data before a Server Action runs. An attacker does not need to break into the application or access protected data.

Key details

• A high-severity denial-of-service flaw in React Server Components lets a remote attacker freeze Next.js servers with a single crafted POST request.
• The vulnerability stems from React repeatedly scanning the full submitted field list for each $K reference during form-data reconstruction before a Server Action runs.
• A request with many references and fields can trigger roughly 100 million string comparisons, consuming CPU and blocking the Node.js event loop.
• Publicly reachable Server Actions are most exposed, but authenticated applications can also be affected when any normal user can reach the vulnerable endpoint.
• React fixed the flaw in versions 19.0.6, 19.1.7, and 19.2.6 by changing the form-data processing path to scan fields once and consume them as handled.
• Next.js users must check their resolved dependency tree for affected react-server-dom packages rather than relying only on the top-level Next.js version.
• NIST classifies the issue as CWE-400, uncontrolled resource consumption, and React's advisory warns of excessive CPU usage, out-of-memory conditions, or server crashes.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.