CVE-2026-23864: React Server Components DoS via memory exhaustion — HIGH (CVSS 7.5), Next.js affected

CVE-2026-23864 (CVSS 7.5 HIGH) is a denial-of-service vulnerability in React Server Components affecting React 19.0.x, 19.1.x, 19.2.x and Next.js 15.x/16.x. Specially crafted unauthenticated HTTP requests to Server Function endpoints cause memory exhaustion and server crash. An incomplete fix from CVE-2025-55184 left prior versions still vulnerable. Patches: React 19.0.4+, 19.1.5+, 19.2.4+; Next.js 16.0.11+ or 15.x patched versions. ODS uses Next.js v16.2.2 for the ODS Dashboard which includes the patch.