{"action":"Upgrade react-server-dom-parcel to 19.0.4 or later.","affected":[{"fixed":"19.0.4","introduced":"19.0.0"},{"fixed":"19.1.5","introduced":"19.1.0-canary-7130d0c6-20241212"},{"fixed":"19.2.4","introduced":"19.2.0-canary-63779030-20250328"}],"component":"react-server-dom-parcel","cve_ids":["CVE-2026-23864"],"ecosystem":"npm","epss":0.02581,"exploited":false,"fixed_versions":["19.0.4","19.1.5","19.2.4"],"ghsa_id":"GHSA-83fc-fqcc-2hmg","id":"tcs_01M5KFBHGDR1NVSP1K2GSSAX4J","modified_at":"2026-02-03T03:04:05.946880Z","published_at":"2026-01-29T15:00:30Z","references":["https://osv.dev/vulnerability/GHSA-83fc-fqcc-2hmg","https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg","https://nvd.nist.gov/vuln/detail/CVE-2026-23864","https://github.com/facebook/react","https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components","https://www.facebook.com/security/advisories/cve-2026-23864"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-83fc-fqcc-2hmg","url":"https://osv.dev/vulnerability/GHSA-83fc-fqcc-2hmg"}],"summary":"React Server Components have multiple Denial of Service Vulnerabilities"}