CVE-2026-23864

CVSS

—

EPSS

0.026 (84.6th percentile)

CISA KEV

Not listed

Exploitation

No report

Public exploits

None seen

State

Unknown

Coverage

• Vercel (blog + changelog)26 Jan, 13:00

  Summary of CVE-2026-23864

  Summary Impact Resolution Fixed in Credit References Multiple high-severity vulnerabilities in React Server Components were responsibly disclosed. Importantly, these vulnerabilities do not allow for Remote Code Execution. We created new rules to address these vulnerabilities and deployed them to…

  ↗vercel.com/changelog/summary-of-cve-2026-23864(opens the publisher's site in a new tab)

What we observed