React Shipped the Fix a Month Ago. Nobody Could See It.

CVE-2026-126187 is a 9.5 in React Server Components — and for four weeks it had no CVE, no security warning, and no scanner that could find it.