An explainer on a deserialization flaw in React's Server Components packages that can lead to unauthenticated remote code execution. It covers what happens, who is affected and how to respond, from a defender's point of view and without attack steps.
- CVE
- CVE-2026-126187 (GHSA-xqc2-xf4c-x3h3; React: Unauthenticated Remote Code Execution in React Server Components)
- Severity
- CVSS v4.0 9.5 (Critical; vector AV:N/AC:L/AT:P/PR:N/UI:N; assigned by GitHub). NVD analysis pending as of 11 November 2026
- Type
- Deserialization of untrusted data (CWE-502)
- Impact
- Unauthenticated remote code execution via crafted payloads. The advisory says it only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value
- Affected
- react-server-dom-webpack, -parcel and -turbopack at 19.0.0 to 19.0.8, 19.1.0 to 19.1.9, 19.2.0 to 19.2.8 and 19.3.0
- Fix
- 19.0.9 / 19.1.10 / 19.2.9 / 19.3.1 (released 14 October 2026)
- Published
- 10 November 2026 (CVE and GitHub advisory)
- Exploitation
- No exploitation reported. Not in KEV as of 12 November 2026
Risk of waiting
No authentication is needed, and success means code runs on the server (high impact on confidentiality, integrity and availability). Narrow conditions help, but flaws in internet-facing servers tend to get examined once they are public. Moving to a published fixed version is a small task, so this site sees little reason to defer it because the conditions are strict.
What kind of vulnerability is it
GitHub's advisory says crafted payloads targeting frameworks that support React Server Components can lead to remote code execution. It is classified as CWE-502 (deserialization of untrusted data).
- No authentication is required (PR:N), it works over the network, and no user interaction is needed (UI:N).
- The advisory says it only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. AT:P in the CVSS v4 vector (attack requirements present) reflects that limit (our interpretation).
- Server Components run React code on the server. The flaw is in the packages that process that traffic.
- The advisory does not describe how the payload is built or the exact conditions, and this site does not either.
- A critical flaw has appeared in this mechanism before. See the overview of Next.js and React vulnerabilities.
Affected scope
| Item | Detail |
|---|---|
| Packages | react-server-dom-webpack / react-server-dom-parcel / react-server-dom-turbopack |
| Affected versions | 19.0.0 to 19.0.8 / 19.1.0 to 19.1.9 / 19.2.0 to 19.2.8 / 19.3.0 |
| Fixed versions | 19.0.9 / 19.1.10 / 19.2.9 / 19.3.1 |
| Not affected | Apps whose React code does not use a server; apps that do not use a framework, bundler or plugin that supports Server Components (per the advisory) |
| Workarounds / mitigations | None found in the advisory |
| Next.js | No official statement found. Check the react-server-dom-* versions in your dependencies |
- The version ranges are from the GitHub advisory body. The CVE record (registered by GitHub) words the versions differently and its text contains a typo, so we cross-checked the fixed version numbers against the advisory body and React's releases.
- The three packages are installed according to your bundler (webpack, Parcel or Turbopack). If more than one is present, check all of them.
How to check whether you are affected
Check whether you use Server Components
Find out whether you use a framework that supports Server Components, such as the Next.js App Router. An app that runs React only in the browser is not affected, per the advisory.
Check react-server-dom-* versions in the lockfile
Search package-lock.json, pnpm-lock.yaml or yarn.lock for react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack, and see whether the version falls in the affected ranges above. They can be present as a framework dependency even if you did not install them directly. For automated dependency checks see monitoring dependencies with osv-scanner.
Check the framework version
Frameworks such as Next.js may bundle or pin react-server-dom-* themselves. Check the framework's official release notes and advisories for a response to this CVE. When we checked on 12 November 2026, we found no official statement from Next.js.
What to do today
Move react-server-dom-* to a fixed version or later (top priority)
Use 19.0.9, 19.1.10, 19.2.9 or 19.3.1 or later, matching the release line you use. For a direct dependency, bump the package version and update the lockfile.
If you go through a framework, watch for the framework's update
If the framework pins the version internally, wait for the framework's update or follow its official guidance. While no guidance exists, check the dependency versions yourself and ask the maintainer if needed. Use dependency overrides only after you have tested that the framework still works.
Test after updating, then deploy
Check the Server Components pages and Server Actions, then deploy. Re-check the versions in the lockfile after the update.
Review logs
Look for suspicious requests to Server Components endpoints and unexpected server errors from before the update. No exploitation is reported, but logs are the only evidence you can check.
Exploitation status
- Neither the advisory nor the CVE record mentions exploitation.
- The CVE is not in CISA's KEV catalog (KEV version 2026.11.10, checked 12 November 2026).
- NVD shows "Received" and has not analysed it. The CVSS v4 score of 9.5 comes from GitHub (the CNA).
- The fixed releases (14 October) came about four weeks before the CVE and advisory (10 November). The release notes only describe an improvement to the transport protocol and do not say it is a vulnerability fix.
Sources
- GitHub — GHSA-xqc2-xf4c-x3h3 React: Unauthenticated Remote Code Execution in React Server Components (affected and fixed versions, non-affected conditions, CVSS v4 9.5)
- React — Security advisory in the React repository
- React — v19.2.9 release (19.0.9, 19.1.10 and 19.3.1 were released the same day)
- CVE.org — CVE-2026-126187 (published 10 November 2026)
- NVD — CVE-2026-126187 (Received)
- Next.js — vercel/next.js security advisories (no mention of this CVE found)
We do not state the impact on Next.js and similar frameworks because no official statement was found. Last verified: 12 November 2026.