{"id":"CVE-2026-23869","kind":"vulnerability","aliases":["CVE-2026-23869"],"related":[],"title":"React Server Components: denial of service via resource exhaustion","description":"WAF Release - 2026-04-15 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 15, 2026\n\n## WAF Release - 2026-04-15\n\nThis week's release introduces a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop (CVE-2026-33057), alongside protections for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643). Additionally, this release includes an update to our existing React Server DoS coverage to address recently identified resource exhaustion vectors (CVE-2026-23869).\n\nKey Findings\n\n- Cisco Secure FMC (CVE-2026-20079): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) that allows an unauthenticated, remote attacker to execute arbitrary commands or bypass security filters.\n- FortiClient EMS (CVE-2026-21643): A critical vulnerability in the FortiClient EMS permitting unauthorized access or administrative configuration manipulation via crafted HTTP requests.\n- Mesop (CVE-2026-33057): A vulnerability in the Mesop Python-based UI framework where unauthenticated attackers can execute arbitrary code by sending specially crafted, Base64-encoded payloads in the request body.\n\nImpact\n\nSuccessful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, gain administrative control over network management infrastructure, or trigger server-side resource exhaustion. Administrators are strongly encouraged to apply official vendor updates.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...aef9415b | N/A | Cisco Secure FMC - RCE via upgradeReadinessCall - CVE:CVE-2026-20079 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...ee7be621 | N/A | FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...c953a72b | N/A | Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...50c08f6f | N/A | React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta | Log | Block | This rule has been merged into the original rule \"React Server - DOS - CVE:CVE-2026-23864 - 1\" (ID: ...61680354) |\n| Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI (beta) | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI (beta) | N/A | Disabled | This is a new detection. |","summary":"A flaw in React Server Components lets remote requests exhaust server resources and cause denial of service. Cloudflare added a WAF detection for this CVE, and NVD scores it high (CVSS 7.5).","severity":"high","cvss":7.5,"epss":0.01551,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudflare","lab-disclosure","package","react","server-components"],"not_affected_if":[],"how_to_check":"- unknown\n- Cloudflare customers: confirm the managed rule \"React Server - DOS\" is set to Block in the WAF ruleset.","fix":"- unknown\n- Cloudflare customers: the managed WAF rule \"React Server - DOS\" is already set to Block per the changelog; the package fix version is not in the sources.","status":"open","published_at":"2026-04-08T20:16:23+00:00","first_seen_at":"2026-10-24T19:12:57+00:00","triaged_at":"2026-10-25T05:29:59+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:29:59Z","model":"claude-haiku-5-5","output":{"fix":"- unknown\n- Cloudflare customers: the managed WAF rule \"React Server - DOS\" is already set to Block per the changelog; the package fix version is not in the sources.","reach":"unknown","title":"React Server Components: denial of service via resource exhaustion","impact":"medium","summary":"A flaw in React Server Components lets remote requests exhaust server resources and cause denial of service. Cloudflare added a WAF detection for this CVE, and NVD scores it high (CVSS 7.5).","category":"package","nicknames":[],"who_cares":["react","server-components"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Server becomes unresponsive from resource exhaustion under crafted requests","analyst_note":"Find the affected React package names, vulnerable and fixed versions at https://nvd.nist.gov/vuln/detail/CVE-2026-23869; the Cloudflare changelog cites CVE-2026-23869 in text but CVE-2026-23864 in the rule table, so confirm which CVE the rule covers.","how_to_check":"- unknown\n- Cloudflare customers: confirm the managed rule \"React Server - DOS\" is set to Block in the WAF ruleset.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The affected package list is truncated in the sources, so the React packages and versions involved are not confirmed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001188,"input_tokens":4425,"output_tokens":1492,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-04':60C,76C '-15':61C,77C '-20079':114C,151C,301C '-2026':11A,14A,97C,113C,119C,142C,150C,185C,207C,300C,323C,345C,364C,384C '-21643':120C,186C,324C '-23864':365C,385C '-23869':12A,15A,143C '-33057':98C,208C,346C '0af34bba':411C '1':366C,386C '15':71C '2026':59C,72C,75C '50c08f6f':357C '61680354':388C '7.5':56B 'access':196C 'action':283C,285C 'add':43B 'addit':121C 'address':135C 'administr':198C,253C,266C 'aef9415b':290C 'allow':169C,245C 'alongsid':99C 'appli':271C 'april':70C 'arbitrari':176C,224C,250C 'attack':173C,221C,247C 'auth':318C 'base':158C,216C 'base64':231C,341C 'base64-encoded':230C 'beta':367C,400C,419C 'block':303C,326C,348C,369C 'bodi':237C 'bypass':179C 'c953a72b':335C 'caus':38B 'center':111C,166C 'changelog':62C,63C 'cisco':107C,146C,162C,292C 'cloudflar':16B,42B,69C,287C,309C,332C,354C,389C,408C 'code':90C,225C,251C,339C 'command':177C 'comment':286C 'compon':3A,24B,30B 'configur':199C 'control':254C 'could':244C 'coverag':133C 'craft':202C,229C 'critic':88C,188C 'cve':10A,13A,49B,96C,112C,118C,141C,149C,184C,206C,298C,299C,321C,322C,343C,344C,362C,363C,382C,383C 'cvss':55B 'denial':4A,39B 'descript':281C 'detect':46B,85C,308C,331C,353C,407C,426C 'disabl':402C,421C 'disclosur':19B 'dos':132C,361C,381C 'ebd81645':392C 'ee7be621':312C 'em':117C,183C,193C,315C 'emb':416C 'encod':232C 'encourag':269C 'execut':91C,175C,223C,249C,340C 'exhaust':9A,34B,139C,265C 'exist':129C 'exploit':240C 'filter':181C 'find':145C 'firewal':109C,164C 'flaw':26B 'fmc':148C,167C,294C 'forticli':116C,182C,192C,314C 'framework':218C 'gain':252C 'high':54B,103C 'high-impact':102C 'html':395C,414C 'http':203C 'id':277C,280C,387C 'identifi':137C 'impact':104C,238C 'improv':67C 'includ':124C 'infrastructur':258C 'inject':320C,396C,415C 'interfac':160C 'introduc':82C 'key':144C 'lab':18B 'lab-disclosur':17B 'legaci':278C 'let':31B 'link':397C 'log':302C,325C,347C,368C 'manag':110C,159C,165C,257C,288C,310C,333C,355C,390C,409C 'manipul':200C 'merg':374C 'mesop':95C,205C,213C,337C 'n/a':291C,313C,336C,358C,393C,401C,412C,420C 'network':256C 'new':64C,84C,284C,307C,330C,352C,406C,425C 'nvd':51B 'offici':272C 'origin':377C 'packag':20B 'payload':233C,342C 'permit':194C 'pre':317C 'pre-auth':316C 'previous':282C 'protect':100C 'python':215C 'python-bas':214C 'rce':92C,295C 'react':1A,21B,28B,130C,359C,379C 'recent':136C 'releas':58C,74C,81C,123C 'remot':32B,89C,172C,338C 'request':33B,204C,236C 'resourc':8A,36B,138C,264C 'rule':276C,279C,371C,378C 'ruleset':275C,289C,311C,334C,356C,391C,410C 'score':52B 'secur':108C,147C,163C,180C,293C 'send':227C 'server':2A,23B,29B,35B,131C,262C,360C,380C 'server-compon':22B 'server-sid':261C 'servic':6A,41B 'side':263C 'special':228C 'sql':319C 'strong':268C 'success':239C 'tag':398C,417C 'trigger':260C 'ui':217C 'unauthent':171C,220C,246C 'unauthor':195C 'updat':65C,126C,274C 'upgradereadinesscal':297C 'uri':399C,418C 'vector':140C 'vendor':273C 'via':7A,201C,296C 'vulner':93C,105C,153C,189C,210C,243C 'waf':45B,57C,73C 'web':157C 'web-bas':156C 'week':79C 'xss':394C,413C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-08T20:16:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cve-assign@fb.com","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/#CVE-2026-23869","url":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/","severity":null,"published_at":"2026-04-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:12:57+00:00","fetched_at":"2026-10-24T19:12:57+00:00","note":"Cloudflare: WAF Release - 2026-04-15 · Changelog"},{"source":"nvd","external_id":"CVE-2026-23869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23869","severity":null,"published_at":"2026-04-08T20:16:23+00:00","modified_at":"2026-07-25T11:10:00+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null},{"source":"epss","external_id":"CVE-2026-23869","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-23869","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2921,"url":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/","title":"Cloudflare: WAF Release - 2026-04-15 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-04-15 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 15, 2026\n\n## WAF Release - 2026-04-15\n\nThis week's release introduces a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop (CVE-2026-33057), alongside protections for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643). Additionally, this release includes an update to our existing React Server DoS coverage to address recently identified resource exhaustion vectors (CVE-2026-23869).\n\nKey Findings\n\n- Cisco Secure FMC (CVE-2026-20079): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) that allows an unauthenticated, remote attacker to execute arbitrary commands or bypass security filters.\n- FortiClient EMS (CVE-2026-21643): A critical vulnerability in the FortiClient EMS permitting unauthorized access or administrative configuration manipulation via crafted HTTP requests.\n- Mesop (CVE-2026-33057): A vulnerability in the Mesop Python-based UI framework where unauthenticated attackers can execute arbitrary code by sending specially crafted, Base64-encoded payloads in the request body.\n\nImpact\n\nSuccessful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, gain administrative control over network management infrastructure, or trigger server-side resource exhaustion. Administrators are strongly encouraged to apply official vendor updates.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...aef9415b | N/A | Cisco Secure FMC - RCE via upgradeReadinessCall - CVE:CVE-2026-20079 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...ee7be621 | N/A | FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...c953a72b | N/A | Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...50c08f6f | N/A | React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta | Log | Block | This rule has been merged into the original rule \"React Server - DOS - CVE:CVE-2026-23864 - 1\" (ID: ...61680354) |\n| Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI (beta) | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI (beta) | N/A | Disabled | This is a new detection. |","published_at":"2026-04-15T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}