Security fix for CVE-2026-23864: React Server Components denial of service
Multiple high-severity denial of service vulnerabilities in React Server Components were patched. These vulnerabilities could cause server crashes, out-of-memory exceptions, or excessive CPU usage when triggered by specially crafted HTTP requests to Server Function endpoints. Immediate upgrades to patched versions are required; Vercel has deployed WAF protections as a temporary measure but is not a substitute for upgrading.
Summary
Impact
Resolution
Fixed in
Credit
References
Multiple high-severity vulnerabilities in React Server Components were responsibly disclosed. Importantly, these vulnerabilities do not allow for Remote Code Execution.
We created new rules to address these vulnerabilities and deployed them to the Vercel WAF to automatically protect all projects hosted on Vercel at no cost. However, do not rely on the WAF for full protection. Immediate upgrades to a patched version are required.
addresses multiple denial of service vulnerabilities in React Server Components. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.CVE-2026-23864
These vulnerabilities are present in versions 19.0.x, 19.1.x, and 19.2.x of the following packages:
These packages are included in the following frameworks and bundlers:
After creating mitigations to address this vulnerability, we deployed them across our globally-distributed platform to protect our customers. We still recommend upgrading to the latest patched version.
Updated releases of React and affected downstream frameworks include fixes to prevent this issue. All users should upgrade to a patched version as soon as possible.
Frameworks and bundlers using the aforementioned packages should install the latest versions provided by their respective maintainers.
We thank from , , from and Xiangwei Zhang of Tencent Security YUNDING LAB for their responsible disclosure.Mufeed VHWinfunc ResearchJoachim ViideRyotaKGMO Flatt Security
React CVE-2026-23864 (CVSS 7.5)
react-server-dom-parcelreact-server-dom-webpackreact-server-dom-turbopack
: 13.x, 14.x, 15.x, and 16.x.Next.js
Other frameworks and plugins that embed or depend on React Server Components implementation (e.g., Vite, Parcel, React Router, RedwoodSDK, Waku)
19.0.4, 19.1.5, 19.2.4.React:
15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5, 16.2.0-canary.9Next.js:
Source: original entry ↗
More from Vercel
Follow Vercel to get its new changes in your feed and email digest.
OpenAI Decisions API now available on AI Gateway
OpenAI's Decisions API is now accessible through Vercel's AI Gateway with an OpenAI-compatible endpoint, enabling decision models to answer typed questions and return probabilities, choices, and scores for routing, triage, and guardrails use cases. Support is available across the OpenAI SDK, AI SDK, HTTP API, and CLI with the latest versions.
Timestamp attributes now supported in Vercel Flags
Vercel Flags now supports timestamp attributes for entities, allowing you to create time-based targeting rules. Use this feature to run limited-time campaigns, show content between specific dates, or target users based on registration date.
Glyph Cluster now available in stealth on AI Gateway
Glyph Cluster, a reasoning model for coding and long-context analysis, is now available as a stealth model on Vercel's AI Gateway for Pro and Enterprise plan teams with purchased AI Gateway credits at no cost during the stealth period. The model supports function calling, streams responses, and can be accessed via AI SDK, OpenAI-compatible APIs, and coding agents.