Post #23613 75 Oct 8, 2026, 18:11 UTC A Single POST Freezes Any Next.js Serverhttps://simonkoeck.com/writeups/react-rsc-formdata-event-loop-dos@secharvester Simon Koeck CVE-2026-23870: A Single POST Freezes Any Next.js Server | Simon Koeck To rebuild one submitted form, React scanned every field in the request once for each reference it contained. Nothing capped either number, so one 900 KB POST makes the server do 100 million checks and freeze.