yohannslm/cve-2026-23869Proof-of-concept exploit for CVE-2026-23869, a denial-of-service vulnerability in React Server Components allowing unauthenticated CPU exhaustion via crafted requests.
This repository contains a Proof of Concept (PoC) for CVE-2026-23869, a vulnerability affecting React Server Components before 19.2.5. The vulnerability allows an attacker to cause a significant CPU charge on the server making it non responsive for minutes with a single unauthenticated request. https://www.imperva.com/blog/react2dos-cve-2026-23869-when-the-flight-protocol-crashes-at-takeoff/
You can find the poc here and test it in your own assets.
It requires a valid action-id. These can be found in front end of web applications, via searching for "createServerReference" for instance.
This PoC is for authorized security testing only. Do not use it against systems without explicit permission.
