VIR Vulnerability Intelligence Relay

CVE-2026-23870

high
Published 2026-05-06 · Modified 2026-05-11
CVSS v3
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2
—
VIR risk
7.5

Description

Facebook React has a Denial of Service Vulnerability in React Server Components

Predictions

Exploit likelihood
83%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

Package impact
EcosystemPackageVulnerableFixed
npm npmreact-server-dom-parcel>=19.0.0,<19.0.619.0.6
npm npmreact-server-dom-turbopack>=19.0.0,<19.0.619.0.6
npm npmreact-server-dom-webpack>=19.0.0,<19.0.619.0.6
npm npmreact-server-dom-parcel>=19.1.0,<19.1.719.1.7
npm npmreact-server-dom-turbopack>=19.1.0,<19.1.719.1.7
npm npmreact-server-dom-webpack>=19.1.0,<19.1.719.1.7
npm npmreact-server-dom-parcel>=19.2.0,<19.2.619.2.6
npm npmreact-server-dom-turbopack>=19.2.0,<19.2.619.2.6
npm npmreact-server-dom-webpack>=19.2.0,<19.2.619.2.6
npm NPMreact-server-dom-webpack>= 19.2.0, < 19.2.619.2.6
npm NPMreact-server-dom-turbopack>= 19.2.0, < 19.2.619.2.6
npm NPMreact-server-dom-parcel>= 19.2.0, < 19.2.619.2.6
npm NPMreact-server-dom-webpack>= 19.1.0, < 19.1.719.1.7
npm NPMreact-server-dom-turbopack>= 19.1.0, < 19.1.719.1.7
npm NPMreact-server-dom-parcel>= 19.1.0, < 19.1.719.1.7
npm NPMreact-server-dom-webpack>= 19.0.0, < 19.0.619.0.6
npm NPMreact-server-dom-turbopack>= 19.0.0, < 19.0.619.0.6
npm NPMreact-server-dom-parcel>= 19.0.0, < 19.0.619.0.6

References

Verify integrity in audit chain (admin only). AS-IS.