Critical React Server Components Flaw Enables Unauthenticated Remote Code Execution

A critical security vulnerability, identified as GHSA-xqc2-xf4c-x3h3, has been discovered in React Server Components, potentially enabling unauthenticated remote code execution. The advisory, published by React on October 14, 2026, assigns a CVSS v4 score of 9.5 to the flaw, underscoring its severity. The vulnerability specifically affects the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages, which are integral to supporting React Server Components across various build environments.

The exploitation of this vulnerability hinges on a highly specific and rare response pattern involving multiple typed arrays and attacker-controlled data. According to React's advisory, specially crafted payloads targeting frameworks that utilize React Server Components can trigger remote code execution. While typed arrays are designed to hold numeric data in defined formats, the vulnerability is triggered when responses containing several of these arrays are combined with attacker-controlled input. The advisory does not provide a detailed technical breakdown or exploit instructions, but the high severity rating reflects the potential impact on data privacy, integrity, and service availability, despite the narrow exploitation condition.

Crucially, exploitation of this flaw does not require any account privileges or user interaction, making it a significant threat to affected applications. The advisory rates the potential effects on data privacy, data integrity, and service availability as high. However, the public disclosure does not specify the prevalence of the required application pattern in production environments, leaving the exact scope of exposure somewhat unclear.

This disclosure is distinct from previous React security issues, such as the React2Shell exploitation (CVE-2025-55182), and no specific CVE identifier has been assigned to this new vulnerability. Evidence of attacks against older flaws does not indicate exploitation of this newer issue.

The affected versions of the react-server-dom packages range from 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0. Patched versions are available as 19.0.9, 19.1.10, 19.2.9, and 19.3.1. Developers are urged to consult the official React security advisory for precise version information, as some patch descriptions may contain minor discrepancies, such as a typo indicating "19.0.09" instead of the correct "19.0.9".

React explicitly recommends that teams immediately upgrade their affected server-dom package versions. Applications that do not utilize server-side React code or lack frameworks, bundlers, or plugins supporting React Server Components are not considered vulnerable. The advisory also notes no claims of active exploitation, which is a critical distinction for accurately assessing exposure and reporting.

This vulnerability highlights the ongoing need for vigilance in securing modern web development frameworks. As applications become more complex with features like server components, the attack surface can expand, necessitating prompt patching and security reviews. Developers should prioritize updating to the latest secure versions to mitigate the risk of remote code execution.