CVE-2026-23869 is a denial of service vulnerability in Meta's React Server Components, specifically in the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages. The vulnerability arises from deserialization of untrusted data and uncontrolled resource consumption. Attackers can send specially crafted HTTP requests to Server Function endpoints, which cause excessive CPU usage lasting up to a minute and ultimately throw a catchable error. The affected versions are 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4. There is no vendor advisory indicating an official fix or patch availability at this time.

The vulnerability allows an unauthenticated attacker to cause a denial of service by triggering excessive CPU consumption on the server hosting the affected React Server Components. This results in degraded service availability for up to a minute per attack attempt. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, consider limiting access to Server Function endpoints or implementing rate limiting to reduce the risk of denial of service. Monitor vendor advisories for updates on remediation.