Multiple denial of service vulnerabilities exist in React Server Components packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerabilities arise from deserialization of untrusted data (CWE-502) and uncontrolled resource consumption (CWE-400). Attackers can trigger these issues by sending specially crafted HTTP requests to Server Function endpoints, potentially causing server crashes, out-of-memory exceptions, or excessive CPU usage. The impact depends on the vulnerable code path exercised, application configuration, and application code. The affected versions explicitly include 19.0.0, 19.1.0, and 19.2.0. Red Hat has published advisories and security errata addressing this issue.

The vulnerability can lead to denial of service conditions in applications using React Server Components by causing server crashes, out-of-memory exceptions, or excessive CPU usage. This impacts availability but does not affect confidentiality or integrity. The CVSS v3.1 base score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Red Hat has issued security advisories and errata that include fixes for this vulnerability. Users should upgrade to the latest package versions that address CVE-2026-23864 to mitigate the risk. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed via Red Hat advisories linked in the vendor advisory content. No additional vendor advisory states that no action is required.