react-server-dom-webpack 19.0.0-19.0.5, 19.1.0-19.1.6, 19.2.0-19.2.5 - DoS via Crafted HTTP Requests
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2026-23870. PoCs published by dwisiswant0, XZ1r0, emresandikci.
AI-analyzed exploit summary This repository contains functional exploit code for CVE-2026-23870, a React server-action stream DoS vulnerability in Next.js v16.2.4. It includes detailed technical analysis, vulnerable code excerpts, and runnable exploit scripts.
Description
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).
Exploits (3)
This repository contains functional exploit code for CVE-2026-23870, a React server-action stream DoS vulnerability in Next.js v16.2.4. It includes detailed technical analysis, vulnerable code excerpts, and runnable exploit scripts.
This repository contains a functional exploit for CVE-2026-23870, a DoS vulnerability in Next.js (pre-16.2.5) caused by unbounded recursion in the RSC (React Server Components) reply parser. The exploit constructs a cyclic RSC payload that exhausts CPU resources when processed by vulnerable versions of Next.js.
This repository provides a CLI tool to scan and fix Next.js projects affected by CVE-2026-23870 and related vulnerabilities. It checks package versions and suggests updates but does not contain exploit code.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H