React Server Components Vulnerability Lets Attackers Freeze Next.js Servers With a Single Request

A high-severity denial-of-service vulnerability (CVE-2026-23870, GHSA-rv78-f8rc-xrxh) in React Server Components (React 19.0.0–19.2.5) allows attackers to send specially crafted multipart POST requests that cause quadratic parsing work when resolving nested $K references, resulting in excessive CPU consumption and blocked Node.js event loop. Affected packages include react-server-dom-webpack, react-server-dom-turbopack, and react-server-dom-parcel; fixes are available in React 19.0.6, 19.1.7, and 19.2.6 and organizations are advised to upgrade, rebuild, redeploy, and monitor for unusual multipart POST activity.