CVE-2026-23869 Denial of Service in React Server Components

# ═══════════════════════════════════════════════════════════════
# Cloudflare WAF Custom Rule — CVE-2026-23869
# Dashboard → Security → WAF → Custom Rules → Create Rule
# ═══════════════════════════════════════════════════════════════

# --- Rule 1: Block exploit payloads (Pro/Business — 8KB inspect) ---
(expression)
(http.request.method eq "POST") and
(any(http.request.headers.names[*] matches "(?i)(?:next-action|rsc-action-id)")) and
(
  (http.request.body.size ge 8192) or
  (http.request.body.raw matches "(?i)charset=") or
  (http.request.body.raw contains "\\u00") or
  (
    (http.request.body.raw contains "_formData") and
    (http.request.body.raw contains "_response") and
    (http.request.body.raw contains "resolved_model") and
    (http.request.body.raw contains ":constructor")
  )
)
Action: Block

# --- Rule 2: Block self-reference pattern ---
(expression)
(http.request.method eq "POST") and
(any(http.request.headers.names[*] matches "(?i)(?:next-action|rsc-action-id)")) and
(http.request.body.raw matches "\$@[0-9]")
Action: Block

# --- Rule 3: Rate limit RSC endpoints ---
(expression)
(http.request.method eq "POST") and
(any(http.request.headers.names[*] matches "(?i)(?:next-action|rsc-action-id)"))
Action: Rate Limit — 30 requests / 60s per IP

# --- Managed Rules (enabled by default) ---
Rule IDs (Paid):
  33aa8a8a948b48b28d40450c5fb92fba  ← Primary exploit
  bc1aee59731c488ca8b5314615fce168  ← Bypass variants
  2694f1610c0b471393b21aef102ec699  ← Promise recursion DoS
  1d54691cb822465183cb49e2f562cf5c  ← Scanner detection

Rule IDs (Free):
  2b5d06e34a814a889bee9a0699702280  ← Primary exploit
  cbdd3f48396e4b7389d6efd174746aff  ← Bypass variants

// ═══════════════════════════════════════════════════════════
// AWS WAF Custom Rule — CVE-2026-23869
// Deploy via Console → WAF → Web ACL → Rules → Add custom
// ═══════════════════════════════════════════════════════════

{
  "Name": "ReactRSC_CVE_2026_23869",
  "Priority": 10,
  "Action": { "Block": {} },
  "Statement": {
    "AndStatement": {
      "Statements": [
        // Condition 1: POST method only
        {
          "RegexMatchStatement": {
            "FieldToMatch": { "Method": {} },
            "RegexString": "POST",
            "TextTransformations": [
              { "Priority": 0, "Type": "NONE" }
            ]
          }
        },
        // Condition 2: RSC header present
        {
          "RegexMatchStatement": {
            "FieldToMatch": {
              "Headers": {
                "MatchPattern": { "All": {} },
                "MatchScope": "KEY",
                "OversizeHandling": "MATCH"
              }
            },
            "RegexString": "(?i)(?:next-action|rsc-action-id)",
            "TextTransformations": [
              { "Priority": 0, "Type": "NONE" }
            ]
          }
        },
        // Condition 3: Malicious body patterns
        {
          "OrStatement": {
            "Statements": [
              {
                "RegexMatchStatement": {
                  "FieldToMatch": {
                    "Body": { "OversizeHandling": "MATCH" }
                  },
                  "RegexString": "\\$\\@",
                  "TextTransformations": [
                    { "Priority": 0, "Type": "URL_DECODE_UNI" },
                    { "Priority": 1, "Type": "JS_DECODE" },
                    { "Priority": 2, "Type": "UTF8_TO_UNICODE" }
                  ]
                }
              },
              {
                "RegexMatchStatement": {
                  "FieldToMatch": {
                    "Body": { "OversizeHandling": "MATCH" }
                  },
                  "RegexString": "(?i)resolved_model[\"']|:constructor[\"']|_response[\"']\\s*:|_formData[\"']\\s*:",
                  "TextTransformations": [
                    { "Priority": 0, "Type": "URL_DECODE_UNI" },
                    { "Priority": 1, "Type": "JS_DECODE" },
                    { "Priority": 2, "Type": "UTF8_TO_UNICODE" }
                  ]
                }
              },
              {
                "RegexMatchStatement": {
                  "FieldToMatch": {
                    "Body": { "OversizeHandling": "MATCH" }
                  },
                  "RegexString": "(?i)charset\\s*=",
                  "TextTransformations": [
                    { "Priority": 0, "Type": "NONE" }
                  ]
                }
              }
            ]
          }
        }
      ]
    }
  },
  "VisibilityConfig": {
    "CloudWatchMetricsEnabled": true,
    "MetricName": "ReactRSC_CVE_2026_23869",
    "SampledRequestsEnabled": true
  }
}

// Managed Rule (also enable):
// AWSManagedRulesKnownBadInputsRuleSet v1.24+

// ═══════════════════════════════════════════════════════════
// Azure WAF Custom Rule — CVE-2026-23869
// Portal → Application Gateway / Front Door → WAF Policy
// ═══════════════════════════════════════════════════════════

{
  "name": "BlockReactRSCExploit",
  "priority": 1,
  "ruleType": "MatchRule",
  "action": "Block",
  "matchConditions": [
    {
      // Condition 1: Request has RSC action header
      "matchVariables": [
        { "variableName": "RequestHeaders",
          "selector": "next-action" }
      ],
      "operator": "Any"
    },
    {
      // Condition 2: Body contains exploit patterns
      "matchVariables": [
        { "variableName": "PostArgs" }
      ],
      "operator": "Contains",
      "matchValues": [
        "constructor",
        "__proto__",
        "prototype",
        "_response",
        "resolved_model",
        "_formData",
        "$@"
      ],
      "transforms": [
        "Lowercase",
        "UrlDecode",
        "RemoveNulls"
      ]
    }
  ]
}

# ═══════════════════════════════════════════════════════════
# Google Cloud Armor — CVE-2026-23869
# Console → Network Security → Cloud Armor → Policy → Rules
# ═══════════════════════════════════════════════════════════

# --- Rule 1: Use preconfigured WAF rules ---
Condition:
(
  has(request.headers['next-action']) ||
  has(request.headers['rsc-action-id'])
) &&
evaluatePreconfiguredWaf('cve-canary', {
  'sensitivity': 0,
  'opt_in_rule_ids': [
    'google-mrs-v202512-id000001-rce',
    'google-mrs-v202512-id000002-rce'
  ]
})

Action: deny-403
Priority: 100

# --- Rule 2: Rate limit RSC endpoints ---
Condition:
has(request.headers['next-action']) ||
has(request.headers['rsc-action-id'])

Action: rate_based_ban
Rate limit: 50 requests / 60s per IP
Ban duration: 300s
Priority: 200

// ═══════════════════════════════════════════════════════════
// Akamai WAF — CVE-2026-23869
// Security Center → Application Security → Custom Rules
// ═══════════════════════════════════════════════════════════

{
  "name": "react2shell_cve_2026_23869",
  "conditions": {
    "all": [
      {
        "type": "requestMethodMatch",
        "positiveMatch": true,
        "values": ["POST"]
      },
      {
        "type": "requestHeaderMatch",
        "positiveMatch": true,
        "headerName": "*",
        "matchOperator": "MATCHES_REGEX",
        "matchValue": "(?i)(?:next-action|rsc-action-id)"
      },
      {
        "any": [
          {
            "type": "contentLengthMatch",
            "positiveMatch": true,
            "matchOperator": "GREATER_THAN",
            "matchValue": 16384
          },
          {
            "type": "requestBodyMatch",
            "matchOperator": "MATCHES_REGEX",
            "matchValue": "(?i)content-type\\s*:[^\\r\\n]*charset\\s*="
          },
          {
            "type": "requestBodyMatch",
            "matchOperator": "CONTAINS",
            "matchValue": "\\u00"
          },
          {
            "all": [
              { "type": "requestBodyMatch", "matchOperator": "CONTAINS",
                "matchValue": "resolved_model" },
              { "type": "requestBodyMatch", "matchOperator": "CONTAINS",
                "matchValue": ":constructor" },
              { "type": "requestBodyMatch", "matchOperator": "CONTAINS",
                "matchValue": "_response" },
              { "type": "requestBodyMatch", "matchOperator": "CONTAINS",
                "matchValue": "_formData" }
            ]
          }
        ]
      }
    ]
  },
  "action": "DENY"
}

# ═══════════════════════════════════════════════════
# Apache — CVE-2026-23869 Protection
# Add to VirtualHost or .htaccess
# Requires: mod_rewrite, mod_headers, mod_ratelimit
# ═══════════════════════════════════════════════════

RewriteEngine On

# --- Block known vulnerability scanners ---
RewriteCond %{HTTP_USER_AGENT} "(?i)(React2ShellScanner|Nuclei.*CVE-2025-55182)"
RewriteRule .* - [F,L]

# --- Limit request body size (128KB) ---
LimitRequestBody 131072

# --- Timeout settings ---
TimeOut 30
ProxyTimeout 30

# --- Block RSC exploit patterns (requires mod_security or mod_rewrite) ---
# Block if Next-Action header + suspicious body patterns
SetEnvIfNoCase ^Next-Action$ "." RSC_REQUEST
SetEnvIfNoCase ^RSC-Action-Id$ "." RSC_REQUEST

# Rate limit RSC endpoints (mod_ratelimit)
<If "env('RSC_REQUEST') == '1'">
    SetOutputFilter RATE_LIMIT
    SetEnv rate-limit 512
</If>

# --- If using mod_security, include the ModSecurity rules above ---

# ═══════════════════════════════════════════════════
# HAProxy — CVE-2026-23869 Protection
# ═══════════════════════════════════════════════════

frontend http_front
    bind *:443 ssl crt /etc/ssl/cert.pem

    # --- Detect RSC headers ---
    acl is_rsc_next    req.hdr(next-action)   -m found
    acl is_rsc_action  req.hdr(rsc-action-id) -m found
    acl is_rsc         is_rsc_next or is_rsc_action
    acl is_post        method POST

    # --- Rate limit: 100 req / 10s per IP ---
    stick-table type ip size 100k expire 60s store http_req_rate(10s)
    acl rsc_rate_exceeded sc0_http_req_rate gt 100
    http-request track-sc0 src if is_rsc is_post
    http-request deny deny_status 429 if is_rsc is_post rsc_rate_exceeded

    # --- Block oversized RSC requests (128KB) ---
    acl body_too_large req.body_size gt 131072
    http-request deny deny_status 413 if is_rsc is_post body_too_large

    # --- Block scanner user agents ---
    acl is_scanner req.hdr(user-agent) -i -m reg "React2ShellScanner|Nuclei.*CVE-2025"
    http-request deny deny_status 403 if is_scanner

    # --- Timeouts ---
    timeout client 30s
    timeout server 30s
    timeout connect 10s

    default_backend app_servers

backend app_servers
    server app1 127.0.0.1:3000 check

# ═══════════════════════════════════════════════════
# Caddy — CVE-2026-23869 Protection
# Caddyfile configuration
# ═══════════════════════════════════════════════════

example.com {
    # --- Rate limit RSC endpoints ---
    rate_limit {
        zone   rsc_zone {
            key    {remote_host}
            events 30
            window 60s
        }
        match {
            method POST
            header Next-Action *
        }
    }

    # --- Request body size limit ---
    request_body {
        max_size 128KB
    }

    # --- Block scanner user agents ---
    @scanner {
        header_regexp User-Agent "(?i)(React2ShellScanner|Nuclei.*CVE-2025)"
    }
    respond @scanner 403

    # --- Timeouts ---
    servers {
        timeouts {
            read_body   30s
            read_header 10s
            write       30s
            idle        120s
        }
    }

    reverse_proxy localhost:3000
}