Search: CVE-2026-23870

CVE-2026-23870 is a high-severity denial of service vulnerability in Meta's react-server-dom-turbopack and related packages. It arises from deserialization of untrusted data and uncontrolled resource consumption. Attackers can trigger server crashes, out-of-memory exceptions, or excessive CPU usage by sending specially crafted HTTP requests to server function endpoints. The vulnerability affects specific versions of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.