React Server Components DoS vulnerability; minimal impact on Netlify

A denial-of-service (DoS) vulnerability (CVE-2026-23864, CVSS 7.5) has been disclosed affecting React Server Components (RSCs), a feature used by Next.js and other React metaframeworks. A malicious payload can cause memory exhaustion or excessive CPU consumption. Next.js has also disclosed two unrelated medium-severity CVEs (CVE-2025-59471, CVE-2025-59472) patched in the same releases. Here's what Netlify customers need to know. Impact on Netlify Nominally, this is a server-side DoS vulnerability. However, on Netlify this has minimal impact: our autoscaling serverless architecture means that a malicious request resulting in a crashed or hung function does not affect other requests. However, active exploitation could increase your function costs. Affected frameworks All RSC frameworks are affected:

• Next.js (see version table below)
• React Router 7 (if using RSC preview)
• Waku
• @parcel/rsc
• @vitejs/plugin-rsc

Astro, Gatsby, and Remix are not affected. React affected versions See the React blog post for full details. Affected versions: 19.0.0–19.0.3 Fixed in: 19.0.4 Affected versions: 19.1.0–19.1.4 Fixed in: 19.1.5 Affected versions: 19.2.0–19.2.3 Fixed in: 19.2.4 Next.js affected versions See the Next.js advisory for full details. Affected versions: 13.3.0+ Fixed in: EOL - no fix Affected versions: 14.x Fixed in: EOL - no fix Affected versions: 15.0.0–15.0.7 Fixed in: 15.0.8 Affected versions: 15.1.0–15.1.10 Fixed in: 15.1.11 Affected versions: 15.2.0–15.2.8 Fixed in: 15.2.9 Affected versions: 15.3.0–15.3.8 Fixed in: 15.3.9 Affected versions: 15.4.0–15.4.10 Fixed in: 15.4.11 Affected versions: 15.5.0–15.5.9 Fixed in: 15.5.10 Affected versions: 15.x canaries Fixed in: 15.6.0-canary.61 Affected versions: 16.0.0–16.0.10 Fixed in: 16.0.11 Affected versions: 16.1.0–16.1.4 Fixed in: 16.1.5 Affected versions: 16.x canaries Fixed in: 16.2.0-canary.9 What should I do? If any of your projects are using an affected version, we recommend upgrading as soon as possible to a patched release. For Next.js 13.x and 14.x users: patches are not planned for these versions. Consider upgrading to Next.js 15.x or 16.x. Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted. Consider deleting these deploys manually. Resources

• React CVE-2026-23864
• React blog post
• Next.js security advisory