Security readout for executives and security teams
Plain-English summary
CVE-2026-23864 can let unauthenticated attackers disrupt websites that use React Server Components. Crafted requests to Server Function endpoints may crash servers, exhaust memory, or consume excessive CPU. The issue is about service availability, not confirmed data theft or code execution in the provided sources.
Executive priority
Treat this as a high-priority availability risk for affected web applications. It does not indicate confirmed compromise, but outages from server crashes or resource exhaustion can affect revenue, customer access, and incident response workload.
Technical view
The CVE affects react-server-dom-webpack, react-server-dom-turbopack, and react-server-dom-parcel versions 19.0.0, 19.1.0, and 19.2.0. It is rated CVSS 7.5, network exploitable, low complexity, no privileges or user interaction, with high availability impact. Associated weaknesses include CWE-1284, CWE-400, and CWE-502.
Likely exposure
Exposure is most likely in applications using React Server Components with reachable Server Function endpoints and one of the listed package versions. Internet-facing deployments have higher business impact because the described outcome is denial of service.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. The vulnerability is still operationally serious because the CVSS vector indicates unauthenticated network attackability with low complexity and high availability impact.
Researcher notes
Evidence supports denial-of-service impact only. The bundle does not provide exploit details, proof of active exploitation, or exact fixed version numbers beyond recommending latest package versions. Avoid broad claims about frameworks or products not listed.
Mitigation direction
- Upgrade affected React Server Components packages to the latest available versions.
- Prioritize internet-facing applications with Server Function endpoints.
- Check Meta and Red Hat advisories for vendor-specific remediation details.
- Monitor production for crashes, memory pressure, and CPU spikes.
- Use rate limiting or protective controls where appropriate while patching.
Validation and detection
- Inventory dependencies for the three affected package names.
- Confirm whether versions 19.0.0, 19.1.0, or 19.2.0 are present.
- Identify routes exposing React Server Components Server Functions.
- Verify deployed builds use upgraded package versions.
- Review logs and metrics for availability anomalies around these endpoints.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1284: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-23864 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-01-26T20:01:54.396Z: Reported to Red Hat.
- 2026-01-26T19:16:38.250Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.facebook.com/security/advisories/cve-2026-23864CVE reference, Meta · x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-23864CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2433059CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23864.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:34608CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13571CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Validation of Specified Quantity in Input
Improper Validation of Specified Quantity in Input represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Deserialization of Untrusted Data
Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.