VULNpocalypse
CriticalVulnerabilityPatch available

React maintainers report critical RCE flaw in React Server Components

React maintainers report a critical unauthenticated RCE flaw in three react-server-dom packages; upgrade to 19.0.9, 19.1.10, 19.2.9 or 19.3.1.

Published
Fixed in
react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack 19.0.9, 19.1.10, 19.2.9, 19.3.1
Exploitation
No evidence in the sources; the advisory does not state that attackers have exploited it in production

What happened

According to the React maintainers’ security advisory GHSA-xqc2-xf4c-x3h3, published on Oct 14, 2026, crafted payloads targeting frameworks that support React Server Components can lead to remote code execution (GitHub: advisory GHSA-xqc2-xf4c-x3h3). GBHackers reports on the advisory and says it assigns a CVSS v4.0 score of 9.5 (GBHackers). The advisory itself rates the issue Critical with the same 9.5 score (GitHub).

The maintainers say this only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value, and they recommend updating immediately (GitHub). GBHackers notes that the advisory does not disclose a detailed exploitation sequence or identify the underlying coding error (GBHackers).

What is not confirmed: the sources do not state that attackers have exploited this in production. GBHackers says the CVSS ratings describe potential consequences and that the advisory does not establish that attackers achieved those outcomes (GBHackers). The advisory lists no known CVE identifier and no CWE classification (GitHub).

Am I affected?

According to the advisory, the vulnerable npm packages are react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack, in versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0 (GitHub).

The maintainers say the following are not affected (GitHub):

  • Apps whose React code does not use a server.
  • Apps that do not use a framework, bundler or bundler plugin supporting React Server Components.

GBHackers adds that the CVSS vector marks additional attack requirements as present, so a critical rating does not mean every app running an affected package has a usable exploitation path (GBHackers). GBHackers also says this issue is separate from an earlier React Server Components remote code execution issue (React2Shell), and that identifiers, affected-version lists and patch guidance from that issue should not be reused here (GBHackers).

What to do now

  1. Check whether your project depends on react-server-dom-webpack, react-server-dom-parcel or react-server-dom-turbopack, directly or through a framework or bundler plugin (GitHub).
  2. Upgrade each affected package to a fixed version: 19.0.9, 19.1.10, 19.2.9 or 19.3.1, matching your current release line (GitHub).
  3. Verify the resolved package versions in lockfiles and production artifacts, then rebuild and redeploy so the corrected code reaches running servers, as GBHackers advises (GBHackers).
  4. Assess this advisory on its own terms. GBHackers cautions that earlier fixed releases from other disclosures can still fall within this issue’s affected ranges (GBHackers).

No workaround other than upgrading is stated in the sources.

Sources