# CVE-2026-23864: Meta react-server-dom-webpack

- Exploited (CISA KEV): no
- Published: 2026-01-26
- CVSS: 7.5 HIGH (v3.1)
- EPSS: 2.6% (85th percentile)

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.

The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.

Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2026-01-26 | 0 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2026-07-07 | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2026-01-26 · new · rule aaede80b4d414dc89c443cea61680354 · default Block
  > React Server - DOS - CVE:CVE-2026-23864 - 1. Previous action: N/A. New action: Block. This is a new detection.
  Source: https://developers.cloudflare.com/changelog/post/2026-01-26-waf-release/
- 2026-01-26 · new · rule 3e93c9faaafa447c83a525f2dcdffcf8 · default Block
  > React Server - DOS - CVE:CVE-2026-23864 - 2. Previous action: N/A. New action: Block. This is a new detection.
  Source: https://developers.cloudflare.com/changelog/post/2026-01-26-waf-release/
- 2026-01-26 · new · rule 930020d567684f19b05fb35b349edbc6 · default Block
  > React Server - DOS - CVE:CVE-2026-23864 - 3. Previous action: N/A. New action: Block. This is a new detection.
  Source: https://developers.cloudflare.com/changelog/post/2026-01-26-waf-release/
- 2026-04-15 · updated · rule d95aa5410d1b4e98bf7a59d150c08f6f · default Block
  > React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta. Previous action: Log. New action: Block. This rule has been merged into the original rule "React Server - DOS - CVE:CVE-2026-23864 - 1" (ID: ...61680354 )
  Source: https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/

### F5

- 2026-07-07 · updated · rule 200012099
  > Updated: signature 200012099 "Next.js Denial of Service (2)" (Denial of Service, risk Medium), systems: Node.js, JavaScript, ReactJS. References: CVE-2026-23864, CVE-2026-23869.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-23864 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-23864