CriticalCVSS9.52026-11-12
CVE-2026-126187 — Unauthenticated remote code execution in React Server Components (react-server-dom-* fixed in 19.0.9, 19.1.10, 19.2.9 and 19.3.1): explainer and fix
A deserialization of untrusted data flaw (CWE-502) in React's Server Components packages (react-server-dom-webpack, -parcel and -turbopack). GitHub's advisory says crafted payloads can lead to unauthenticated remote code execution, with a CVSS v4 score of 9.5 (Critical). The advisory also says it only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. The fixed versions were released on 14 October 2026 and the advisory was published on 10 November. No exploitation is reported. This site's view: the score is high, so any app using Server Components should check the react-server-dom-* versions it depends on and move to a fixed version.