https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:47:20 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337478 EUVD-2026-337478 https://cve.radiocsirt.org/vuln/euvd-2026-337478 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23869 <p>A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.</p> <p>A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23869 https://cve.radiocsirt.org/vuln/ghsa-479c-33wc-g2pg <p><strong>Affected:</strong> npm: react-server-dom-parcel, npm: react-server-dom-turbopack, npm: react-server-dom-webpack</p> <p>## Impact</p> <p>A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack versions 19.0.0, 19.1.0 and 19.2.0. The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.</p> <p>The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.</p> <p>We recommend updating immediately.</p> <p>The vulnerability exists in versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4 of:</p> <p>[react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)</p> <p>## Patches</p> <p>Fixes were back ported to versions 19.0.5, 19.1.6, and 19.2.5.</p> <p>If you are using any of the above packages please upgrade to any of the fixed versions immediately.</p> <p>If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.</p> <p>## References</p> <p>See the [blog post](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more information and upgrade instructions.</p> <p><strong>Affected:</strong> npm: react-server-dom-parcel, npm: react-server-dom-turbopack, npm: react-server-dom-webpack</p> <p>## Impact</p> <p>A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack versions 19.0.0, 19.1.0 and 19.2.0. The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.</p> <p>The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.</p> <p>We recommend updating immediately.</p> <p>The vulnerability exists in versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4 of:</p> <p>[react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)</p> <p>## Patches</p> <p>Fixes were back ported to versions 19.0.5, 19.1.6, and 19.2.5.</p> <p>If you are using any of the above packages please upgrade to any of the fixed versions immediately.</p> <p>If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.</p> <p>## References</p> <p>See the [blog post](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more information and upgrade instructions.</p> https://cve.radiocsirt.org/vuln/ghsa-479c-33wc-g2pg https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1011 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1011