A denial of service vulnerability exists in React Server Components

#!/usr/bin/env python3
# check_cve_2026_23869.py
# Detects vulnerable react-server-dom-* package versions for CVE-2026-23869.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import json
import os
import re
import sys

TARGETS = {
    'react-server-dom-webpack': [('19.0.0','19.0.4'), ('19.1.0','19.1.5'), ('19.2.0','19.2.4')],
    'react-server-dom-parcel': [('19.0.0','19.0.4'), ('19.1.0','19.1.5'), ('19.2.0','19.2.4')],
    'react-server-dom-turbopack': [('19.0.0','19.0.4'), ('19.1.0','19.1.5'), ('19.2.0','19.2.4')],
}

FIXED = ['19.0.5', '19.1.6', '19.2.5']


def normalize(v):
    if not isinstance(v, str):
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)', v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def in_range(ver, start, end):
    v = normalize(ver)
    s = normalize(start)
    e = normalize(end)
    if not v or not s or not e:
        return False
    return cmp_ver(v, s) >= 0 and cmp_ver(v, e) <= 0


def vulnerable(pkg, ver):
    for start, end in TARGETS.get(pkg, []):
        if in_range(ver, start, end):
            return True
    return False


def collect_from_package_lock(lock_path):
    found = {}
    try:
        with open(lock_path, 'r', encoding='utf-8') as f:
            data = json.load(f)
    except Exception:
        return found

    def record(name, ver, source):
        if name in TARGETS and isinstance(ver, str):
            found.setdefault(name, []).append((ver, source))

    packages = data.get('packages')
    if isinstance(packages, dict):
        for path, meta in packages.items():
            if not isinstance(meta, dict):
                continue
            name = meta.get('name')
            ver = meta.get('version')
            if name in TARGETS:
                record(name, ver, f'{os.path.basename(lock_path)}:{path or "."}')
            else:
                # Derive package name from path like node_modules/<name>
                if isinstance(path, str):
                    for target in TARGETS:
                        if path.endswith('node_modules/' + target):
                            record(target, ver, f'{os.path.basename(lock_path)}:{path}')

    deps = data.get('dependencies')
    if isinstance(deps, dict):
        def walk(dep_map, prefix='dependencies'):
            for name, meta in dep_map.items():
                if not isinstance(meta, dict):
                    continue
                ver = meta.get('version')
                if name in TARGETS:
                    record(name, ver, f'{os.path.basename(lock_path)}:{prefix}.{name}')
                child = meta.get('dependencies')
                if isinstance(child, dict):
                    walk(child, prefix=f'{prefix}.{name}.dependencies')
        walk(deps)

    return found


def collect_from_node_modules(root):
    found = {}
    nm = os.path.join(root, 'node_modules')
    if not os.path.isdir(nm):
        return found
    for pkg in TARGETS:
        pkg_json = os.path.join(nm, pkg, 'package.json')
        if os.path.isfile(pkg_json):
            try:
                with open(pkg_json, 'r', encoding='utf-8') as f:
                    data = json.load(f)
                ver = data.get('version')
                if isinstance(ver, str):
                    found.setdefault(pkg, []).append((ver, 'node_modules'))
            except Exception:
                pass
    return found


def merge(a, b):
    out = dict(a)
    for k, vals in b.items():
        out.setdefault(k, []).extend(vals)
    return out


def dedupe(found):
    out = {}
    for pkg, vals in found.items():
        seen = set()
        out[pkg] = []
        for ver, src in vals:
            key = (ver, src)
            if key not in seen:
                seen.add(key)
                out[pkg].append((ver, src))
    return out


def main():
    root = sys.argv[1] if len(sys.argv) > 1 else os.getcwd()
    if not os.path.isdir(root):
        print('UNKNOWN: target path does not exist or is not a directory')
        sys.exit(2)

    found = {}
    for filename in ('package-lock.json', 'npm-shrinkwrap.json'):
        path = os.path.join(root, filename)
        if os.path.isfile(path):
            found = merge(found, collect_from_package_lock(path))

    found = merge(found, collect_from_node_modules(root))
    found = dedupe(found)

    if not found:
        print('UNKNOWN: could not find target packages in package-lock.json, npm-shrinkwrap.json, or node_modules')
        sys.exit(2)

    vulnerable_hits = []
    checked = []
    for pkg, vals in sorted(found.items()):
        for ver, src in vals:
            checked.append(f'{pkg}@{ver} [{src}]')
            if vulnerable(pkg, ver):
                vulnerable_hits.append(f'{pkg}@{ver} [{src}]')

    if vulnerable_hits:
        print('VULNERABLE: ' + '; '.join(vulnerable_hits))
        sys.exit(1)

    print('PATCHED: checked ' + '; '.join(checked) + f'; fixed upstream versions include {", ".join(FIXED)}')
    sys.exit(0)


if __name__ == '__main__':
    main()