1. Home
  2. Reference documentation
  3. Changelog
  4. 2026
  5. April 2026

Added virtual patch for CVE-2026-23869 (React Server Components DoS)

April 8, 2026
ngwaf-announcementsadded

A Denial of Service vulnerability has been found in React Server Components and has been assigned CVE-2026-23869. Fastly has created a virtual patch for it that is now available within your account. To activate it and add protection to your services, follow the steps for your control panel below.

Next-Gen WAF control panel

  1. Professional and Premier platforms or packaged offerings
  2. Essential platform

If you're on the Professional or Premier platform or have purchased the Security Core, Security Core Plus, or Security Total packaged offering, complete the following steps:

  1. Log in to the Next-Gen WAF control panel.

  2. From the Sites menu, select a site if you have more than one site.

  3. From the Rules menu, select Templated Rules.
  4. In the search bar, enter CVE-2026-23869 and then click View for the CVE-2026-23869 templated rule.
  5. Click Configure and then Add trigger.
  6. Select the Block requests from an IP immediately if the CVE-2026-23869 signal is observed checkbox.
  7. Click Update rule.

Fastly control panel

If you're using the Fastly control panel, complete the following steps:

  1. Log in to the Fastly control panel.

  2. Go to Security > Next-Gen WAF > Workspaces.

  3. Click Virtual Patches.
  4. In the search bar, enter CVE-2026-23869 and then click the pencil Pencil icon to the right of the CVE-2026-23869 virtual patch.
  5. From the Status menu, select Enabled.
  6. (Optional) If your workspace is in blocking mode, choose whether to Block requests or Log requests if the CVE-2026-23869 signal is observed.
  7. Click Update virtual patch.

Prior change: On-Prem WAF deployments now use Digital Elements geolocation data

Fastly
© Fastly 2026