--- title: Summary of CVE-2026-23864 | daily.dev description: Multiple high-severity denial of service vulnerabilities (CVE-2026-23864, CVSS 7.5) were discovered in React Server Components affecting versions 19.0.x... canonical: https://daily.dev/posts/vtg76z5rk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Summary of CVE-2026-23864 | daily.dev og:description: Multiple high-severity denial of service vulnerabilities (CVE-2026-23864, CVSS 7.5) were discovered in React Server Components affecting versions 19.0.x... og:url: https://daily.dev/posts/vtg76z5rk og:image: https://api.daily.dev/og/posts/Vtg76Z5Rk.png og:image:alt: Post cover image og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Summary of CVE-2026-23864 **[CyberVerse](https://daily.dev/sources/cygullem)** · [@cygullem](https://daily.dev/cygullem) · 1 upvotes · 0 comments ## Summary Multiple high-severity denial of service vulnerabilities (CVE-2026-23864, CVSS 7.5) were discovered in React Server Components affecting versions 19.0.x through 19.2.x. The vulnerabilities can be triggered through specially crafted HTTP requests to Server Function endpoints, potentially causing server crashes, out-of-memory exceptions, or excessive CPU usage. Affected frameworks include Next.js versions 13.x through 16.x, along with other tools using React Server Components. Vercel deployed WAF mitigations automatically, but immediate upgrades to patched versions are required. Fixes are available in React 19.0.4+, 19.1.5+, 19.2.4+ and corresponding Next.js versions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Security Advisory: CVE-2025-66478](https://daily.dev/posts/security-advisory-cve-2025-66478-rsgtgvc3z) · Next.js · 5 upvotes · 0 comments - [RCE in React Server Components](https://daily.dev/posts/rce-in-react-server-components-qz5nloolf) · Hacker News · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#react](https://daily.dev/tags/react), [#nextjs](https://daily.dev/tags/nextjs), [#vercel](https://daily.dev/tags/vercel) [View this post on daily.dev](https://daily.dev/posts/vtg76z5rk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/vtg76z5rk","headline":"Summary of CVE-2026-23864","text":"Shared: Summary of CVE-2026-23864","url":"https://daily.dev/posts/vtg76z5rk","datePublished":"2026-01-30T13:55:19.321Z","dateModified":"2026-01-30T13:55:19.324Z","author":{"@type":"Person","name":"Cy Gullem","url":"https://daily.dev/cygullem","image":"https://lh3.googleusercontent.com/a/ACg8ocK5vjISgYakLwtZYJ5m5qe1jlPTDZVxMs9Udd50L-6ywqsi5mo=s96-c","description":"Can write code with REACT, NEXT and C#","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":2670}},"image":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"sharedContent":{"@type":"WebPage","url":"https://api.daily.dev/r/igYAcLEa7"},"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/cygullem","name":"CyberVerse"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CyberVerse","item":"https://daily.dev/squads/cygullem"},{"@type":"ListItem","position":3,"name":"Summary of CVE-2026-23864"}]} ```