TLDR Tech / Practical
Vulnerability in Next.js servers can be exploited by a single POST request
A security flaw in React Server Components has been identified, where a single POST request can cause a Node.js server to freeze. This issue arises from unmanaged recursive pointer resolution during the rebuilding of form data. An attacker can exploit this by sending nested pointers and filler data, triggering millions of string comparisons on a single thread. The vulnerability affects React versions 19.0 through 19.2 and has been addressed in versions 19.0.6, 19.1.7, and 19.2.6, receiving the identifier CVE-2026-23870.
Read the full story