CVE-2026-23864 | Meta react-server-dom-webpack up to 19.0.3/19.1.4/19.2.3 React Server deserialization

A vulnerability was found in Meta react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel up to 19.0.3/19.1.4/19.2.3. It has been declared as critical. This affects an unknown part of the component React Server Component. The manipulation results in deserialization. This vulnerability is cataloged as CVE-2026-23864. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.