Summary of CVE-2026-23864
By Steven Van ·
Vercel's WAF now blocks a second, more severe React Server Components DoS flaw, but patched React and Next.js versions are still required.
Vercel deployed new Web Application Firewall rules to block a second round of denial of service vulnerabilities in React Server Components, after fixes for an earlier DoS issue turned out to be incomplete.
CVE-2026-23864 (CVSS 7.5) affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack in versions 19.0.x, 19.1.x, and 19.2.x, which ship inside Next.js 13.x through 16.x and other frameworks and bundlers that use React Server Components, including Vite, Parcel, React Router, RedwoodSDK, and Waku. Specially crafted HTTP requests to Server Function endpoints can cause server crashes, out-of-memory exceptions, or excessive CPU usage. The vulnerabilities do not allow remote code execution.
The WAF rules protect all projects hosted on Vercel automatically at no cost, but Vercel says not to rely on the WAF for full protection and recommends upgrading immediately to a patched release: React 19.0.4, 19.1.5, or 19.2.4, or the corresponding fixed Next.js versions. Apps that don't use a server, or don't use a framework or bundler with React Server Components support, are not affected. Full details are in the GitHub security advisory.