# What changed in react-server-dom-parcel

> 12 changes in react-server-dom-parcel 19 from its official release notes, upgrade guides and advisories: 7 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-28. HTML: https://unstale.sh/npm/react-server-dom-parcel/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## react-server-dom-parcel 19

### Security

- Facebook React has a Denial of Service Vulnerability in React Server Components (19.1.7, 19.2.6) — [security advisory](https://github.com/advisories/GHSA-RV78-F8RC-XRXH)
- React Server Components have a Denial of Service Vulnerability (19.1.6, 19.2.5) — [security advisory](https://github.com/advisories/GHSA-479C-33WC-G2PG)
- React Server Components have multiple Denial of Service Vulnerabilities (19.1.5, 19.2.4) — [security advisory](https://github.com/advisories/GHSA-83FC-FQCC-2HMG)
- Denial of Service Vulnerability in React Server Components (19.1.4, 19.2.3) — [security advisory](https://github.com/advisories/GHSA-7GMR-MQ3H-M5H9)
- Denial of Service Vulnerability in React Server Components (19.1.3, 19.2.2) — [security advisory](https://github.com/advisories/GHSA-2M3V-V2M8-Q956)
- Source Code Exposure Vulnerability in React Server Components (19.1.3, 19.2.2) — [security advisory](https://github.com/advisories/GHSA-925W-6V3X-G4J4)
- React Server Components are Vulnerable to RCE (19.1.2, 19.2.1) — [security advisory](https://github.com/advisories/GHSA-FV66-9V8Q-G76R)

### New APIs and options

- Adds an option to the Flight Client to allow partial streams. (19.3.0) — [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1930-september-9-2026)

### Behavior and default changes

- Server Components can now render context providers from client modules. (19.3.0) — [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1930-september-9-2026)
- Flight now transports Error.cause, allowing the cause to be preserved across serialization. (19.3.0) — [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1930-september-9-2026)

### Fixes and other changes

- Flight now transports AggregateError.errors across serialization. (19.3.0) — [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1930-september-9-2026)
- Fixed missing FormData entries in Server Actions, a regression in 19.2.6. (19.1.8, 19.2.7) — [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1927-june-1-2026), [release notes](https://github.com/react/react/blob/e8738f0c628b4c321c5ce8077390ba48a8208341/CHANGELOG.md#1918-june-1-2026)