# What changed in react-is

> 14 changes in react-is 19 from its official release notes, upgrade guides and advisories: 9 security. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/react-is/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## react-is 19

### Security

- Facebook React has a Denial of Service Vulnerability in React Server Components (19.0.6, 19.1.7, 19.2.6) — [security advisory](https://github.com/advisories/GHSA-RV78-F8RC-XRXH)
- React Server Components have a Denial of Service Vulnerability (19.0.5, 19.1.6, 19.2.5) — [security advisory](https://github.com/advisories/GHSA-479C-33WC-G2PG)
- React Server Components have multiple Denial of Service Vulnerabilities (19.0.4, 19.1.5, 19.2.4) — [security advisory](https://github.com/advisories/GHSA-83FC-FQCC-2HMG)
- Denial of Service Vulnerability in React Server Components (19.0.3, 19.1.4, 19.2.3) — [security advisory](https://github.com/advisories/GHSA-7GMR-MQ3H-M5H9)
- Denial of Service Vulnerability in React Server Components (19.0.2, 19.1.3, 19.2.2) — [security advisory](https://github.com/advisories/GHSA-2M3V-V2M8-Q956)
- Source Code Exposure Vulnerability in React Server Components (19.0.2, 19.1.3, 19.2.2) — [security advisory](https://github.com/advisories/GHSA-925W-6V3X-G4J4)
- React Server Components are Vulnerable to RCE (19.0.1, 19.1.2, 19.2.1) — [security advisory](https://github.com/advisories/GHSA-FV66-9V8Q-G76R)
- Adds DoS mitigations to Server Actions and hardens Server Components. (19.0.4, 19.1.5) — [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1915-jan-26-2026), [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1904-jan-26-2026)
- Hardened Server Components. (19.0.4) — [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1904-jan-26-2026)

### Performance

- Type hardening and performance improvements were made to React Server Components. (19.2.6) — [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1926-may-6-2026)

### Behavior and default changes

- React Server Functions have extra loop protection. (19.0.3, 19.1.4, 19.2.3) — [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1923-dec-11-2025), [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1914-dec-11-2025), [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1903-dec-11-2025)

### Fixes and other changes

- Fixed missing FormData entries in Server Actions, a regression introduced in 19.2.6. (19.1.8, 19.2.7) — [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1927-june-1-2026), [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1918-june-1-2026)
- React Server Component fixes are brought to Server Actions. (19.0.1, 19.1.2, 19.2.1) — [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1921-dec-3-2025), [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1912-dec-3-2025), [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1901-dec-3-2025)
- Adds more cycle protections in React Server Components. (19.0.5, 19.1.6) — [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1916-march-18-2026), [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1905-march-18-2026)