React-Flight

Next.js RSC Server-Action DoS via Flight Deserialization (CVE-2026-23870)

CVE-2026-23870 is a pre-authentication Denial of Service against any Next.js deployment using the App Router. An attacker sends crafted HTTP POST requests to any App Router server function endpoint with a deeply-cyclic or wide fan-out React Flight protocol…