Single Request Can Freeze Next.js Servers via React Server Components Flaw

Organisations deploying React 19 face a significant availability risk due to CVE-2026-23870, a high-severity vulnerability in React Server Components. According to GBHackers, this flaw allows attackers to freeze servers using Next.js and similar frameworks with a single, specially crafted request. Meta has assigned the issue a CVSS score of 7.5, highlighting its potential to severely disrupt service availability for affected applications.

How does the vulnerability affect server performance?

The flaw stems from how React manages Server Actions, specifically during the reconstruction of multipart form data from raw HTTP requests. Researcher Simonkoeck identified that attackers can exploit a $K reference type to force React into resolving nested form data structures. For each reference, the code iterates over the entire list of submitted fields to find matches, creating a quadratic processing burden that consumes excessive CPU resources.

A request containing 10,000 $K references and 10,000 filler fields can generate approximately 100 million string checks, according to the report. This occurs despite the request size being only about 900 KB. Because Node.js typically processes JavaScript on a single event-loop thread, this workload blocks other requests, causing pages, APIs, and additional Server Action calls to stall or time out until parsing completes.

Can attackers exploit this without authentication?

Yes, the vulnerable deserialization process occurs before application-level authorization checks for the Server Action are executed. This means an attacker may not need to authenticate if an affected Server Action endpoint is accessible from a public page. The low attack complexity and lack of privilege requirements make this a critical exposure for any publicly facing web application using these components.

Attackers only need a Server Action identifier to proceed, which often appears in rendered HTML or JavaScript assets sent to clients’ browsers. Consequently, any public-facing page that includes simple Server Actions may provide sufficient attack surface for exploitation. The issue is categorised as CWE-400, referring to uncontrolled resource consumption, and is tracked as GHSA-rv78-f8rc-xrxh alongside the CVE identifier.

What components are impacted by this issue?

The vulnerability affects React Server Components packages utilised by frameworks such as Next.js, specifically within vulnerable releases of React 19. According to GBHackers, the issue impacts the core mechanism of server-side function invocation during form submissions. Organisations relying on these specific versions for dynamic content delivery are directly exposed to the denial-of-service condition described in the technical report.

Meta’s assignment of a 7.5 CVSS score reflects the significant impact on availability and the ease of exploitation over a network. The flaw does not require user interaction, allowing automated tools to potentially target multiple endpoints. The scope of impact includes any service dependent on the affected React Server Components for processing user input or form data.

What immediate steps should teams take?

Teams should audit their React 19 deployments to identify if they are using the vulnerable releases mentioned in the report. Since no fix has been confirmed yet in the source material, organisations should consider restricting access to Server Action endpoints or implementing rate limiting on HTTP POST requests. Monitoring for unusual CPU spikes or request timeouts can help detect ongoing exploitation attempts before they cause widespread service degradation.

What to do and how to stay safe: React

• Review server logs for unusually large HTTP POST requests or spikes in CPU usage on React 19 endpoints.
• Restrict access to Server Action endpoints to authenticated users only, where possible, to reduce the attack surface.
• Implement rate limiting on form submission endpoints to mitigate the impact of quadratic processing attacks.
• Monitor for new vendor advisories regarding CVE-2026-23870 and apply updates once the vendor provides a confirmed fix.

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-23870?

It is a high-severity vulnerability in React Server Components that allows attackers to cause denial of service via crafted HTTP POST requests.

Does exploitation require authentication?

No, the deserialization process occurs before authorization checks, allowing unauthenticated attackers to exploit accessible Server Action endpoints.

Which frameworks are affected?

Frameworks such as Next.js that utilise vulnerable releases of React 19 and React Server Components are affected by this flaw.