Skip to content
OpenAdvisories
Critical · 9.5 Public exploit CVE-2026-126187 EUVD-2026-123052GHSA-xqc2-xf4c-x3h3

React: Unauthenticated Remote Code Execution in React Server Components

Published Nov 10, 2026 · Updated Nov 13, 2026 · Assigned by GitHub_M

Vendor: react Product: react Package: react Package: react-server-dom-parcel Package: react-server-dom-turbopack Package: react-server-dom-webpack Ecosystem: npm Ecosystem: Ubuntu

Description

React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.

Affected products

VendorProductAffectedFixed
react react >= 19.0.0, < 19.0.9, >= 19.1.0, < 19.1.10, >= 19.2.0, < 19.2.9, >= 19.3.0, < 19.3.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 react No fix yet —
Ubuntu 26.04 LTS react No fix yet —
Ubuntu 24.04 LTS react No fix yet —
Ubuntu 22.04 LTS react No fix yet —
Ubuntu 20.04 LTS react No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS react No fix yet —
Ubuntu 16.04 LTS react No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

  • briskets/CVE-2026-126187-poc ★ 35 · Nov 8, 2026

    CVE-2026-126187 Unauthenticated RCE in React Server Components - PoC and Docker lab for GHSA-xqc2-xf4c-x3h3 / GHSA-673q-mjm6-r5xr

  • TahuCryptsi/poc-cve-2026-126187-rsc-usecache-rce ★ 3 · Nov 12, 2026

    PoC: unauth RCE via Next.js use-cache typed-array framing desync (CVE-2026-126187 / GHSA-xqc2-xf4c-x3h3) | docker compose lab

  • rudSarkar/GHSA-673q-mjm6-r5xr ★ 0 · Nov 11, 2026

    Dockerized remote RCE PoC for GHSA-673q-mjm6-r5xr (Next.js use cache / React Flight, CVE-2026-126187): one unauthenticated request -> code execution, with a patched victim that is immune.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm react-server-dom-parcel >= 19.0.0, < 19.0.9 19.0.9 GHSA-xqc2-xf4c-x3h3
npm react-server-dom-parcel >= 19.1.0, < 19.1.10 19.1.10 GHSA-xqc2-xf4c-x3h3
npm react-server-dom-parcel >= 19.2.0, < 19.2.9 19.2.9 GHSA-xqc2-xf4c-x3h3
npm react-server-dom-parcel >= 19.3.0, < 19.3.1 19.3.1 GHSA-xqc2-xf4c-x3h3
npm react-server-dom-turbopack >= 19.0.0, < 19.0.9 19.0.9 GHSA-xqc2-xf4c-x3h3
npm react-server-dom-turbopack >= 19.1.0, < 19.1.10 19.1.10 GHSA-xqc2-xf4c-x3h3
npm react-server-dom-turbopack >= 19.2.0, < 19.2.9 19.2.9 GHSA-xqc2-xf4c-x3h3
npm react-server-dom-turbopack >= 19.3.0, < 19.3.1 19.3.1 GHSA-xqc2-xf4c-x3h3
npm react-server-dom-webpack >= 19.0.0, < 19.0.9 19.0.9 GHSA-xqc2-xf4c-x3h3
npm react-server-dom-webpack >= 19.1.0, < 19.1.10 19.1.10 GHSA-xqc2-xf4c-x3h3
npm react-server-dom-webpack >= 19.2.0, < 19.2.9 19.2.9 GHSA-xqc2-xf4c-x3h3
npm react-server-dom-webpack >= 19.3.0, < 19.3.1 19.3.1 GHSA-xqc2-xf4c-x3h3

Advisories 1

References