---
id: "CVE-2026-23869"
kind: "vulnerability"
aliases: ["CVE-2026-23869"]
title: "React Server Components: denial of service via resource exhaustion"
severity: "high"
cvss: 7.5
epss: 0.01551
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cloudflare", "lab-disclosure", "package", "react", "server-components"]
not_affected_if: []
published_at: "2026-04-08T20:16:23+00:00"
first_seen_at: "2026-10-24T19:12:57+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/", "first_seen_at": "2026-10-24T19:12:57+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23869", "first_seen_at": "2026-10-24T19:23:38+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-23869", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# React Server Components: denial of service via resource exhaustion

A flaw in React Server Components lets remote requests exhaust server resources and cause denial of service. Cloudflare added a WAF detection for this CVE, and NVD scores it high (CVSS 7.5).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown
- Cloudflare customers: confirm the managed rule "React Server - DOS" is set to Block in the WAF ruleset.

## Fix

- unknown
- Cloudflare customers: the managed WAF rule "React Server - DOS" is already set to Block per the changelog; the package fix version is not in the sources.

## Timeline

- 2026-10-24T19:12:57+00:00 lab https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/ — Cloudflare: WAF Release - 2026-04-15 · Changelog
- 2026-10-24T19:23:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-23869
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-23869

## Documents

- [advisory] Cloudflare: WAF Release - 2026-04-15 · Changelog https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/

## From the sources

WAF Release - 2026-04-15 · Changelog

# Changelog

New updates and improvements at Cloudflare.

April 15, 2026

## WAF Release - 2026-04-15

This week's release introduces a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop (CVE-2026-33057), alongside protections for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643). Additionally, this release includes an update to our existing React Server DoS coverage to address recently identified resource exhaustion vectors (CVE-2026-23869).

Key Findings

- Cisco Secure FMC (CVE-2026-20079): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) that allows an unauthenticated, remote attacker to execute arbitrary commands or bypass security filters.
- FortiClient EMS (CVE-2026-21643): A critical vulnerability in the FortiClient EMS permitting unauthorized access or administrative configuration manipulation via crafted HTTP requests.
- Mesop (CVE-2026-33057): A vulnerability in the Mesop Python-based UI framework where unauthenticated attackers can execute arbitrary code by sending specially crafted, Base64-encoded payloads in the request body.

Impact

Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, gain administrative control over network management infrastructure, or trigger server-side resource exhaustion. Administrators are strongly encouraged to apply official vendor updates.

| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
| --- | --- | --- | --- | --- | --- | --- |
| Cloudflare Managed Ruleset | ...aef9415b | N/A | Cisco Secure FMC - RCE via upgradeReadinessCall - CVE:CVE-2026-20079 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...ee7be621 | N/A | FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...c953a72b | N/A | Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...50c08f6f | N/A | React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta | Log | Block | This rule has been merged into the original rule "React Server - DOS - CVE:CVE-2026-23864 - 1" (ID: ...61680354) |
| Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI (beta) | N/A | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI (beta) | N/A | Disabled | This is a new detection. |

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_