New React vulns leak secrets, invite DoS attacks