React Server Components: Unauthenticated remote code execution

Summary

The server-side packages react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack in React 19 contain a flaw in how they process responses that carry multiple typed arrays together with an attacker-controlled value. An unauthenticated attacker can send a crafted payload over the network and execute code on the server. The flaw only applies to web applications that run React Server Components on the server through a framework, bundler or bundler plugin that supports them; client-only React applications are not affected. A public proof-of-concept claim has been reported, but no confirmed exploitation in attacks has been found.

Affected

• react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack from 19.0.0 to 19.0.8
• Same packages from 19.1.0 to 19.1.9
• Same packages from 19.2.0 to 19.2.8
• Same packages 19.3.0
• Applications that use React Server Components through a supporting framework or bundler (for example Next.js App Router) are affected through their bundled runtime

Fixed in

• 19.0.9
• 19.1.10
• 19.2.9
• 19.3.1

Upgrade react, react-dom and the react-server-dom-* packages together to the same fixed version. Frameworks such as Next.js must be updated to a release that includes the fixed runtime.

Workaround

Unknown. No official mitigation has been published by the vendor; upgrading to a fixed version is the recommended fix. A third-party proof of concept suggests removing use cache functions that return multiple typed arrays alongside attacker-controlled values, but this is not an official mitigation and has not been verified.

Exploitation

• Public proof-of-concept: a third-party repository claimed a working proof of concept on 8 November 2026; the code was not reviewed for this entry
• In the wild: no confirmed exploitation found at the time of writing
• The vendor describes the triggering conditions as extremely rare, but a public proof of concept lowers the barrier

Our recommendation

• Identify all web applications that use React Server Components, including Next.js App Router, Parcel or Vite RSC plugins and vendor-supplied applications
• Check lockfiles and the bundled runtime for react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack, not only the top-level react version
• Update to the fixed versions and update the framework (for example Next.js) to a release that includes the fix
• Prioritise internet-facing applications and ask suppliers for their patch status
• Review web server logs for unusual requests to server action endpoints and treat any hits as potentially serious

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (3 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  briskets/CVE-2026-126187-poc · rudSarkar/GHSA-673q-mjm6-r5xr · TahuCryptsi/poc-cve-2026-126187-rsc-usecache-rce

Research sources

• GitHub Security Advisory GHSA-xqc2-xf4c-x3h3 github.com
• CVE Record CVE-2026-126187 www.cve.org
• React 19.0.9 release github.com
• React 19.1.10 release github.com
• React 19.2.9 release github.com
• React 19.3.1 release github.com
• Fix commit for React 19.0.x (0c9913a) github.com
• React 19.1.x fix commit (249ac87) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 00:21.