Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

React Server Components packages enable remote code execution

CVE-2026-126187 · published today
Summary

Versions of the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages can be tricked into running malicious code if an attacker can send specially crafted data. This risk only applies to applications that use React Server Components with those packages. Update to the latest patched versions right away to remove the risk.

What to do
  • Update GitHub Actions react-server-dom-parcel to version 19.0.9.
  • Update GitHub Actions react-server-dom-parcel to version 19.1.10.
  • Update GitHub Actions react-server-dom-parcel to version 19.2.9.
  • Update GitHub Actions react-server-dom-parcel to version 19.3.1.
  • Update GitHub Actions react-server-dom-turbopack to version 19.0.9.
  • Update GitHub Actions react-server-dom-turbopack to version 19.1.10.
  • Update GitHub Actions react-server-dom-turbopack to version 19.2.9.
  • Update GitHub Actions react-server-dom-turbopack to version 19.3.1.
  • Update GitHub Actions react-server-dom-webpack to version 19.0.9.
  • Update GitHub Actions react-server-dom-webpack to version 19.1.10.
  • Update GitHub Actions react-server-dom-webpack to version 19.2.9.
  • Update GitHub Actions react-server-dom-webpack to version 19.3.1.
  • Update react-server-dom-parcel to version 19.0.9.
  • Update react-server-dom-parcel to version 19.1.10.
  • Update react-server-dom-parcel to version 19.2.9.
  • Update react-server-dom-parcel to version 19.3.1.
  • Update react-server-dom-turbopack to version 19.0.9.
  • Update react-server-dom-turbopack to version 19.1.10.
  • Update react-server-dom-turbopack to version 19.2.9.
  • Update react-server-dom-turbopack to version 19.3.1.
  • Update react-server-dom-webpack to version 19.0.9.
  • Update react-server-dom-webpack to version 19.1.10.
  • Update react-server-dom-webpack to version 19.2.9.
  • Update react-server-dom-webpack to version 19.3.1.
Affected software
Ecosystem VendorProductAffected versions
– react react >= 19.0.0, < 19.0.9
npm GitHub Actions react-server-dom-parcel >= 19.0.0, < 19.0.9
>= 19.1.0, < 19.1.10
>= 19.2.0, < 19.2.9
>= 19.3.0, < 19.3.1
Fix: upgrade to 19.0.9
npm GitHub Actions react-server-dom-turbopack >= 19.0.0, < 19.0.9
>= 19.1.0, < 19.1.10
>= 19.2.0, < 19.2.9
>= 19.3.0, < 19.3.1
Fix: upgrade to 19.0.9
npm GitHub Actions react-server-dom-webpack >= 19.0.0, < 19.0.9
>= 19.1.0, < 19.1.10
>= 19.2.0, < 19.2.9
>= 19.3.0, < 19.3.1
Fix: upgrade to 19.0.9
npm – react-server-dom-parcel >= 19.0.0, < 19.0.9
>= 19.1.0, < 19.1.10
>= 19.2.0, < 19.2.9
>= 19.3.0, < 19.3.1
Fix: upgrade to 19.0.9
npm – react-server-dom-turbopack >= 19.0.0, < 19.0.9
>= 19.1.0, < 19.1.10
>= 19.2.0, < 19.2.9
>= 19.3.0, < 19.3.1
Fix: upgrade to 19.0.9
npm – react-server-dom-webpack >= 19.0.0, < 19.0.9
>= 19.1.0, < 19.1.10
>= 19.2.0, < 19.2.9
>= 19.3.0, < 19.3.1
Fix: upgrade to 19.0.9
Original advisory text
React: Unauthenticated Remote Code Execution in React Server Components
React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published10 Nov 2026
Updated11 Nov 2026
First seen10 Nov 2026
Sources
CVE-2026-126187 · NVD
CVE-2026-126187 · MITRE
GHSA-xqc2-xf4c-x3h3 · GHSA
GHSA-xqc2-xf4c-x3h3 · OSV
CVE-2026-126187 · OSV
Track software like this
Free during beta