React fixes critical remote code flaw in its Server Components packages

React fixes critical remote code flaw in its Server Components packages

10 November 2026: The React project has fixed CVE-2026-126187, a critical flaw in the packages that carry React Server Components between server and browser, which lets an attacker who is not logged in run code on the server with a crafted payload. It scores 9.5 under CVSS 4.0, fixes are out for four release lines, and the advisory makes no statement about exploitation.

Not yet independently verified. The advisory is the React project's own and the only primary source; it states no exploitation either way, and the NVD entry had not been published when we read it. Frameworks that bundle these packages had not issued their own notes by 11:00 UTC on 11 November, so we cannot yet say which framework versions carry the fix. We will update this when it can be confirmed, and remove this note.

Which packages and versions are hit

Three npm packages are named, all of them the server side of React's component streaming: react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack. The vulnerable and fixed versions are the same for all three:

Vulnerable	Fixed in
19.0.0 to 19.0.8	19.0.9
19.1.0 to 19.1.9	19.1.10
19.2.0 to 19.2.8	19.2.9
19.3.0	19.3.1

The advisory text writes the first fix as "19.0.09"; the patched version recorded in GitHub's advisory database is 19.0.9, which is the release that exists. React 18 and earlier lines are not listed.

How narrow the trigger is

The project says the payload works only in "extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value". The weakness is classed as deserialization of untrusted data (CWE-502), and the CVSS 4.0 vector marks it as reachable over the network with low complexity, no privileges and no user interaction, with one attack precondition. That precondition is the rare response shape, which is why the score stops at 9.5 rather than 10.

Rarity of the trigger does not change the advice. The advisory asks anyone using the packages to upgrade "immediately", and a server that accepts requests from the internet and renders Server Components is exactly the setup the vector describes. Italy's national cybersecurity agency, ACN, repeated the warning on 11 November.

Who can stop reading here

Two groups are outside the flaw, in the project's own words. An app whose React code does not use a server is not affected, so a single-page app built and served as static files is fine. An app that uses no framework, bundler or bundler plugin supporting Server Components is not affected either.

Everyone else should look at the lockfile rather than package.json. These packages usually arrive as dependencies of a framework or bundler plugin rather than being installed by hand, so the version that matters is the one resolved in package-lock.json, pnpm-lock.yaml or yarn.lock. Some frameworks ship their own compiled copy of the React server packages, and in that case only a framework release carries the fix; when we checked the release pages of the most widely used Server Components framework at 11:00 UTC on 11 November, its newest stable and canary releases did not mention this advisory.

Credit and timing

The advisory credits a researcher with the GitHub handle evolutionstorm. It went public at 22:44 UTC on 10 November, together with the 19.0.9, 19.1.10, 19.2.9 and 19.3.1 releases.

Related on TrustList:

• Next.js 16.4.1 fixes two critical flaws that need no login to exploit
• Next.js patches seven cache and cookie flaws in 16.4.5 and 15.5.29

Sources

• React (GitHub security advisory GHSA-xqc2-xf4c-x3h3): Unauthenticated Remote Code Execution in React Server Components, published 10 November 2026 22:44 UTC, 10 November 2026
• GitHub Advisory Database API record for GHSA-xqc2-xf4c-x3h3 (patched versions and CVSS 4.0 vector), read 11 November 2026, 11 November 2026
• Agenzia per la Cybersicurezza Nazionale (Italy): Risolta vulnerabilità in React, 11 November 2026, 11 November 2026