CVE-2026-23870 | Meta react-server-dom-turbopack up to 19.0.5/19.1.6/19.2.5 HTTP deserialization (GHSA-rv78-f8rc-xrxh)

A vulnerability marked as problematic has been reported in Meta react-server-dom-turbopack, react-server-dom-parcel and react-server-dom-webpack up to 19.0.5/19.1.6/19.2.5. This affects an unknown part of the component HTTP Handler. The manipulation leads to deserialization.

This vulnerability is referenced as CVE-2026-23870. Remote exploitation of the attack is possible. No exploit is available.