I’M UNDER A CYBER ATTACK

Alert

Logo de React

Alert 2026-153 Unauthenticated remote code execution in React Server Components

First update: Nov 11, 2026

Proof-of-concept code has been published that demonstrates CVE-2026-126187. The code reproduces the case described by the vendor — responses that transport multiple typed arrays and an attacker-controlled value — and invokes a Server Action with arguments chosen by the caller. In a lab with Next.js 16.4.0 and React 19.3.0, the author reports that the action runs; on 16.4.1, it does not. In a real application, the impact depends on what that action does: not every affected application has one that executes system commands. The vendor still recommends updating immediately, and the Next.js advisory says applications should be updated even if they do not have similar functions. No confirmed active exploitation was identified. The fix is unchanged: update to 19.0.9, 19.1.10, 19.2.9, or 19.3.1, depending on the branch, or Next.js to 16.4.1 or later, and redeploy.

Affected product(s): 

ProductAffected versionsFixed in
react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack19.0.0 through 19.0.8; 19.1.0 through 19.1.9; 19.2.0 through 19.2.8; and 19.3.019.0.9, 19.1.10, 19.2.9, or 19.3.1, depending on the branch
Next.js (next package)16.0.0 through 16.4.0, according to this product’s own advisory. That advisory does not list the 15 branch for this vulnerability16.4.1

React applications that do not use a server, or do not use a framework, bundler, or bundler plugin with React Server Components support, are not affected.

Description

The identifier CVE-2026-126187 has been published for an unauthenticated remote code execution vulnerability in the React Server Components packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. The vendor advisory and patches are available as of Oct 14, 2026; the CVE was made public on Nov 10, 2026. This is not the critical React Server Components vulnerability from December 2025: it is a separate advisory, from October 2026.

According to the vendor, a crafted payload targeting frameworks that support React Server Components can execute code on the server. It states that this occurs only in extremely rare cases, when responses carry multiple typed arrays and an attacker-controlled value; nevertheless, it recommends updating immediately. It rates the vulnerability with CVSS 4.0 9.5, critical. Versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0 are affected. The fix is available in 19.0.9, 19.1.10, 19.2.9, and 19.3.1, depending on the branch.

Next.js published its own advisory for the same vulnerability, without a separate CVE, also rated CVSS 4.0 9.5, critical, and addresses it in version 16.4.1 (affects next 16.0.0 through 16.4.0). In that environment, updating react or react-dom alone is not sufficient: the next package must be updated because it may include a bundled copy of the runtime. The Next.js advisory states that there is no workaround and that updating is recommended even if the application does not have features of that kind. The same security release batch of Oct 14, 2026 also released Next.js 15.5.28, which addresses other vulnerabilities; there is no statement that the 15 branch is affected by CVE-2026-126187. Users of another React Server Components framework should update the react-server-dom-* packages to the patched versions and consult that framework’s guidance.

Public proof-of-concept code has been published that demonstrates the flaw. No confirmed active exploitation was identified. The vendor advisory does not report exploitation, and as of Nov 11, 2026 the issue does not appear in catalogs of known exploited vulnerabilities.

Mitigation

It is recommended to inventory applications that use React Server Components, either directly or through a framework such as Next.js, and check the version of react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack and, in Next.js, the version of next. The appearance of public proof-of-concept code increases the urgency of updating and redeploying.

Update the affected packages to 19.0.9, 19.1.10, 19.2.9, or 19.3.1, depending on the branch, or Next.js to 16.4.1 or later. In Next.js, it should not rely solely on a react or react-dom upgrade. Then redeploy the applications, including preview environments or branches that are still serving an earlier package.

The Next.js advisory states that there is no workaround for affected applications; updating is the remedy. The vendor did not publish any indicators of compromise. The patch does not undo a previous compromise.

Solution

The solution is to update react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack to 19.0.9, 19.1.10, 19.2.9, or 19.3.1, depending on the branch, and, in affected Next.js applications, update next to 16.4.1 or later; then redeploy.

For information on how to update, visit the following link:

https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3

Additional information: