React CVE-2026-126187: Critical RCE in Server Components
TL;DR · the short version
CVE-2026-126187 (GHSA-xqc2-xf4c-x3h3) is a critical unauthenticated remote code execution flaw in React Server Components, scored CVSS v4 9.5 and classed as deserialization of untrusted data. The React advisory, published on GitHub on 14 October 2026 and added to the GitHub Advisory Database on 10 November, says crafted payloads sent to frameworks that support React Server Components can lead to code execution. It affects react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack from 19.0.0 up to the patched releases 19.0.9, 19.1.10, 19.2.9 and 19.3.1. The advisory says it only affects extremely rare cases where responses carry multiple typed arrays and an attacker-controlled value, and that apps with no server-component support are not affected. It states no workaround and does not say whether the flaw is being exploited. Next.js shipped fixes on 14 October (16.4.1 and 15.5.28) for a related advisory about use cache functions returning typed arrays. Find every app that uses server components, check the lockfile, and update.
CVE-2026-126187 is a critical remote code execution flaw in React Server Components. The GitHub advisory GHSA-xqc2-xf4c-x3h3 scores it CVSS v4 9.5 (critical, no login needed) and says crafted payloads sent to frameworks that support React Server Components can lead to remote code execution. Fixes are in React 19.0.9, 19.1.10, 19.2.9 and 19.3.1. The advisory was published on 14 October 2026 and added to the GitHub Advisory Database on 10 November 2026, which is why it is circulating again now.
Who this is for: CISOs, AppSec and platform leads, and anyone whose product runs Next.js or another framework that uses React Server Components.
Based on the advisory and the Next.js security update, both read on 11 November 2026. PlayCISO is not affiliated with React, Meta or Vercel. We publish no exploit details.
Confirmed vs not yet known
The advisory confirms: unauthenticated remote code execution, CVSS v4 9.5 (vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N), CWE-502, three affected packages, four patched releases, and credit to the finder "evolutionstorm". It says "Updating immediately is recommended."
The advisory also limits it: "This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value." An app whose React code does not use a server is not affected, and neither is an app with no framework, bundler or plugin that supports React Server Components.
Not stated: any workaround, whether it is being exploited, and any framework by name. cve.now, a secondary aggregator, says it is not in CISA KEV and that no public exploit code is tracked; treat that as a snapshot, not a guarantee.
Dates differ by source: GitHub shows the React advisory published on 14 October 2026 and listed in its advisory database on 10 November; cve.now shows 10 November for both published and updated.
Affected and fixed versions
The advisory lists the same ranges for all three packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack.
| Release line | Affected | Patched |
|---|---|---|
| 19.0 | 19.0.0 up to but not including 19.0.9 | 19.0.9 |
| 19.1 | 19.1.0 up to but not including 19.1.10 | 19.1.10 |
| 19.2 | 19.2.0 up to but not including 19.2.9 | 19.2.9 |
| 19.3 | 19.3.0 up to but not including 19.3.1 | 19.3.1 |
One note on sources: the advisory's prose once spells the first patched version "19.0.09"; every other mention, and the table, say 19.0.9. cve.now additionally lists the react package itself and says 19.0.9 "was never published"; we did not check npm, and the advisory lists 19.0.9 as patched, so check the registry for the version you intend to install.
Next.js
The Next.js security update of 14 October 2026 covers an advisory it titles unauthenticated remote code execution in use cache functions returning typed arrays (GHSA-673q-mjm6-r5xr, critical), affecting apps that use the App Router with Cache Components when a use cache function returns multiple typed arrays. It names the React advisory GHSA-xqc2-xf4c-x3h3 as the related upstream advisory, fixed in Next.js 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS), and says there is no known workaround. The post does not print CVE-2026-126187 and does not state which earlier Next.js versions are affected, so confirm your own line against the advisory rather than assuming. The later Next.js release of 3 November 2026 (16.4.5 and 15.5.29) lists other issues and does not mention React Server Components.
What the viral post leaves out
The shared summary, "an unauthenticated attacker can run arbitrary code on the server by sending a crafted request", is correct as far as it goes and its fix list (19.0.9, 19.1.10 and more) matches the advisory. It leaves out the narrow trigger quoted above. That condition makes broad exposure less likely, but you cannot see it from the outside, and with no workaround stated the safe move is to patch.
Useful next, if this was relevant to you
Not the same as React2Shell
CVE-2025-55182, nicknamed React2Shell, was an earlier pre-authentication remote code execution flaw in the same packages. The Auth0 advisory for it (published 4 December 2025, CVSS v3.1 10.0) lists patched versions 19.0.1, 19.1.2 and 19.2.1. Those do not fix CVE-2026-126187, so a lockfile that was updated last December can still be vulnerable now.
Timeline
| Date | Event | Source |
|---|---|---|
| 4 Dec 2025 | Auth0 publishes its advisory for the earlier CVE-2025-55182 in the same packages | Auth0 advisory |
| 14 Oct 2026 | React advisory GHSA-xqc2-xf4c-x3h3 published; Next.js releases 16.4.1 and 15.5.28 for the related use cache advisory | GitHub, Next.js |
| 3 Nov 2026 | Next.js November security release (16.4.5 and 15.5.29); not about React Server Components | Next.js |
| 10 Nov 2026 | Advisory added to the GitHub Advisory Database; cve.now lists the CVE as published | GitHub, cve.now |
What security leaders should do this week
- Find every app that uses server components. Next.js with the App Router is the common case; also ask about other frameworks or bundlers that support them. The advisory says apps without that support are not affected.
- Read the lockfile, not the manifest. Check the resolved versions of
react-server-dom-webpack,react-server-dom-turbopackandreact-server-dom-parcelagainst the table above, and the resolved Next.js version against 16.4.1 or 15.5.28 (or later on your line). - Update, then redeploy. A fixed lockfile that was never built into the running image changes nothing. Confirm the deployed version.
- Do not rely on a workaround. Neither the advisory nor Next.js states one.
- Ask your hosting and platform vendors whether they patched, and when, for anything you do not build yourself.
- Prioritise with data. Check the CVE in the KEV checker and EPSS lookup, then decide the deadline with the SSVC calculator or vulnerability prioritizer. Re-check KEV daily until it is patched everywhere.
- Record it in your risk register with an owner and a date, including the unpatched systems you could not update this week.
Frequently asked questions
What is CVE-2026-126187?
A critical (CVSS v4 9.5) unauthenticated remote code execution flaw in React Server Components, classed CWE-502 (deserialization of untrusted data). The GitHub advisory says crafted payloads sent to frameworks that support React Server Components can lead to remote code execution, and that it affects the react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack packages.
Which React versions fix CVE-2026-126187?
Update each release line to its patched version: 19.0.9, 19.1.10, 19.2.9 or 19.3.1. The advisory lists the affected ranges as 19.0.0 to before 19.0.9, 19.1.0 to before 19.1.10, 19.2.0 to before 19.2.9 and 19.3.0 to before 19.3.1, for all three react-server-dom packages. The advisory says updating immediately is recommended and states no workaround.
Is my app affected if I do not use server components?
The advisory says an app whose React code does not use a server is not affected, and that apps without a framework, bundler or bundler plugin that supports React Server Components are not affected. It also says the flaw only affects "extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value", so a headline of "any crafted request" overstates how many apps are reachable. Check anyway: you cannot judge that condition from the outside.
Is Next.js affected, and which version fixes it?
Next.js published a security update on 14 October 2026 for an advisory titled unauthenticated remote code execution in use cache functions returning typed arrays (GHSA-673q-mjm6-r5xr), fixed in 16.4.1 and 15.5.28, and it cites the React advisory as the related upstream advisory. The post does not name CVE-2026-126187 and does not state which earlier Next.js versions are affected. It says there is no known workaround. If you run Next.js with the App Router, move to a fixed version on your line and check your lockfile.
Is CVE-2026-126187 being exploited?
The GitHub advisory does not say. The CVE aggregator cve.now says it is not in CISA KEV and tracks no public exploit code, which is a secondary source and can change quickly, so check CISA KEV again before you rely on it.
Is this the same as React2Shell (CVE-2025-55182)?
No. CVE-2025-55182 was an earlier pre-authentication remote code execution flaw in the same React Server Components packages, disclosed in December 2025 and fixed in 19.0.1, 19.1.2 and 19.2.1. CVE-2026-126187 has different affected and fixed versions (19.0.9, 19.1.10, 19.2.9, 19.3.1), so being patched for the 2025 issue does not mean you are patched for this one.
Sources
- GitHub Advisory GHSA-xqc2-xf4c-x3h3: React: Unauthenticated Remote Code Execution in React Server Components (published 14 Oct 2026; added to the GitHub Advisory Database 10 Nov 2026)
- Next.js: Next.js Security Update for Upstream Vulnerabilities (14 October 2026)
- Next.js: November 2026 security release (3 November 2026)
- cve.now: CVE-2026-126187 (secondary aggregator; dates and KEV status per that page, 10 November 2026)
- Auth0 advisory GHSA-4wch-r8cm-c87x for the earlier CVE-2025-55182 (4 December 2025)
- Not usable: the NVD record returned an empty page when we opened it, and the react.dev blog had no post for this CVE on 11 November 2026.