tocsin

CVE-2026-23864

3 advisories.

npm/react-server-dom-parcel CVE-2026-23864: high 7.5, EPSS 2.58%

React Server Components have multiple Denial of Service Vulnerabilities

Action: Upgrade react-server-dom-parcel to 19.0.4 or later.

npm i react-server-dom-parcel@19.0.4
npm i react-server-dom-parcel@19.1.5
npm i react-server-dom-parcel@19.2.4

Affected

introducedfixedlast affected
19.0.019.0.4-
19.1.0-canary-7130d0c6-2024121219.1.5-
19.2.0-canary-63779030-2025032819.2.4-

Fixed versions

19.0.419.1.519.2.4

Sources

CVE-2026-23864 · published · modified · JSON

npm/react-server-dom-turbopack CVE-2026-23864: high 7.5, EPSS 2.58%

React Server Components have multiple Denial of Service Vulnerabilities

Action: Upgrade react-server-dom-turbopack to 19.0.4 or later.

npm i react-server-dom-turbopack@19.1.5
npm i react-server-dom-turbopack@19.0.4
npm i react-server-dom-turbopack@19.2.4

Affected

introducedfixedlast affected
19.1.0-canary-7130d0c6-2024121219.1.5-
19.0.019.0.4-
19.2.0-canary-63779030-2025032819.2.4-

Fixed versions

19.1.519.0.419.2.4

Sources

CVE-2026-23864 · published · modified · JSON

npm/react-server-dom-webpack CVE-2026-23864: high 7.5, EPSS 2.58%

React Server Components have multiple Denial of Service Vulnerabilities

Action: Upgrade react-server-dom-webpack to 19.0.4 or later.

npm i react-server-dom-webpack@19.2.4
npm i react-server-dom-webpack@19.1.5
npm i react-server-dom-webpack@19.0.4

Affected

introducedfixedlast affected
19.2.0-canary-63779030-2025032819.2.4-
19.1.0-canary-7130d0c6-2024121219.1.5-
19.0.019.0.4-

Fixed versions

19.2.419.1.519.0.4

Sources

CVE-2026-23864 · published · modified · JSON