Is Your React App Vulnerable to the CVE-2026-23870 DoS Attack?

**Executive Summary:** A high-severity Denial of Service vulnerability (CVE-2026-23870, CVSS 7.5) has been disclosed in React Server Components (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack) affecting versions 19.0.0–19.0.5, 19.1.0–19.1.6, and 19.2.0–19.2.5; specially crafted HTTP requests against server function endpoints may exhaust CPU and memory, crashing or rendering servers unresponsive, and maintainers have released backported fixes (19.0.6, 19.1.7, 19.2.6) — upgrade server-side RSC dependencies immediately if applicable.