--- title: "React CVE-2026-126187: Critical RCE in Server Components" url: https://playciso.com/blog/react-server-components-rce-cve-2026-126187 updated: 2026-11-11 section: Blog publisher: PlayCISO --- # React CVE-2026-126187: Critical RCE in Server Components > CVE-2026-126187 (CVSS 9.5): crafted payloads can run code on servers using React Server Components. Fixed in 19.0.9, 19.1.10, 19.2.9, 19.3.1. Source: https://playciso.com/blog/react-server-components-rce-cve-2026-126187 · Published: 2026-11-11 · Publisher: PlayCISO (https://playciso.com) Primary source: https://github.com/advisories/GHSA-xqc2-xf4c-x3h3 --- **CVE-2026-126187 is a critical remote code execution flaw in React Server Components.** The [GitHub advisory GHSA-xqc2-xf4c-x3h3](https://github.com/advisories/GHSA-xqc2-xf4c-x3h3) scores it CVSS v4 **9.5** (critical, no login needed) and says crafted payloads sent to frameworks that support React Server Components can lead to remote code execution. Fixes are in React **19.0.9, 19.1.10, 19.2.9 and 19.3.1**. The advisory was published on 14 October 2026 and added to the GitHub Advisory Database on 10 November 2026, which is why it is circulating again now. **Who this is for:** CISOs, AppSec and platform leads, and anyone whose product runs Next.js or another framework that uses React Server Components. *Based on the advisory and the Next.js security update, both read on 11 November 2026. PlayCISO is not affiliated with React, Meta or Vercel. We publish no exploit details.* Confirmed vs not yet known **The advisory confirms:** unauthenticated remote code execution, CVSS v4 9.5 (vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N), CWE-502, three affected packages, four patched releases, and credit to the finder "evolutionstorm". It says "Updating immediately is recommended." **The advisory also limits it:** "This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value." An app whose React code does not use a server is not affected, and neither is an app with no framework, bundler or plugin that supports React Server Components. **Not stated:** any workaround, whether it is being exploited, and any framework by name. cve.now, a secondary aggregator, says it is not in CISA KEV and that no public exploit code is tracked; treat that as a snapshot, not a guarantee. **Dates differ by source:** GitHub shows the React advisory published on 14 October 2026 and listed in its advisory database on 10 November; cve.now shows 10 November for both published and updated. ## Affected and fixed versions The advisory lists the same ranges for all three packages: `react-server-dom-parcel`, `react-server-dom-turbopack` and `react-server-dom-webpack`. | Release line | Affected | Patched | | --- | --- | --- | | 19.0 | 19.0.0 up to but not including 19.0.9 | 19.0.9 | | 19.1 | 19.1.0 up to but not including 19.1.10 | 19.1.10 | | 19.2 | 19.2.0 up to but not including 19.2.9 | 19.2.9 | | 19.3 | 19.3.0 up to but not including 19.3.1 | 19.3.1 | One note on sources: the advisory's prose once spells the first patched version "19.0.09"; every other mention, and the table, say 19.0.9. cve.now additionally lists the `react` package itself and says 19.0.9 "was never published"; we did not check npm, and the advisory lists 19.0.9 as patched, so check the registry for the version you intend to install. ## Next.js The [Next.js security update of 14 October 2026](https://nextjs.org/blog/nextjs-security-update-october-14-2026) covers an advisory it titles unauthenticated remote code execution in `use cache` functions returning typed arrays (GHSA-673q-mjm6-r5xr, critical), affecting apps that use the App Router with Cache Components when a `use cache` function returns multiple typed arrays. It names the React advisory GHSA-xqc2-xf4c-x3h3 as the related upstream advisory, fixed in Next.js **16.4.1** (Active LTS) and **15.5.28** (Maintenance LTS), and says there is no known workaround. The post does not print CVE-2026-126187 and does not state which earlier Next.js versions are affected, so confirm your own line against the advisory rather than assuming. The later [Next.js release of 3 November 2026](https://nextjs.org/blog/november-2026-security-release) (16.4.5 and 15.5.29) lists other issues and does not mention React Server Components. ## What the viral post leaves out The shared summary, "an unauthenticated attacker can run arbitrary code on the server by sending a crafted request", is correct as far as it goes and its fix list (19.0.9, 19.1.10 and more) matches the advisory. It leaves out the narrow trigger quoted above. That condition makes broad exposure less likely, but you cannot see it from the outside, and with no workaround stated the safe move is to patch. ## Not the same as React2Shell CVE-2025-55182, nicknamed React2Shell, was an earlier pre-authentication remote code execution flaw in the same packages. The [Auth0 advisory for it](https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-4wch-r8cm-c87x) (published 4 December 2025, CVSS v3.1 10.0) lists patched versions 19.0.1, 19.1.2 and 19.2.1. Those do not fix CVE-2026-126187, so a lockfile that was updated last December can still be vulnerable now. ## Timeline | Date | Event | Source | | --- | --- | --- | | 4 Dec 2025 | Auth0 publishes its advisory for the earlier CVE-2025-55182 in the same packages | Auth0 advisory | | 14 Oct 2026 | React advisory GHSA-xqc2-xf4c-x3h3 published; Next.js releases 16.4.1 and 15.5.28 for the related use cache advisory | GitHub, Next.js | | 3 Nov 2026 | Next.js November security release (16.4.5 and 15.5.29); not about React Server Components | Next.js | | 10 Nov 2026 | Advisory added to the GitHub Advisory Database; cve.now lists the CVE as published | GitHub, cve.now | ## What security leaders should do this week - Find every app that uses server components. Next.js with the App Router is the common case; also ask about other frameworks or bundlers that support them. The advisory says apps without that support are not affected. - Read the lockfile, not the manifest. Check the resolved versions of react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel against the table above, and the resolved Next.js version against 16.4.1 or 15.5.28 (or later on your line). - Update, then redeploy. A fixed lockfile that was never built into the running image changes nothing. Confirm the deployed version. - Do not rely on a workaround. Neither the advisory nor Next.js states one. - Ask your hosting and platform vendors whether they patched, and when, for anything you do not build yourself. - Prioritise with data. Check the CVE in the [KEV checker](/tools/kev-checker) and [EPSS lookup](/tools/epss-lookup), then decide the deadline with the [SSVC calculator](/tools/ssvc-calculator) or [vulnerability prioritizer](/tools/vulnerability-prioritizer). Re-check KEV daily until it is patched everywhere. - Record it in your risk register with an owner and a date, including the unpatched systems you could not update this week. ## Frequently asked questions ### What is CVE-2026-126187? A critical (CVSS v4 9.5) unauthenticated remote code execution flaw in React Server Components, classed CWE-502 (deserialization of untrusted data). The GitHub advisory says crafted payloads sent to frameworks that support React Server Components can lead to remote code execution, and that it affects the react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack packages. ### Which React versions fix CVE-2026-126187? Update each release line to its patched version: 19.0.9, 19.1.10, 19.2.9 or 19.3.1. The advisory lists the affected ranges as 19.0.0 to before 19.0.9, 19.1.0 to before 19.1.10, 19.2.0 to before 19.2.9 and 19.3.0 to before 19.3.1, for all three react-server-dom packages. The advisory says updating immediately is recommended and states no workaround. ### Is my app affected if I do not use server components? The advisory says an app whose React code does not use a server is not affected, and that apps without a framework, bundler or bundler plugin that supports React Server Components are not affected. It also says the flaw only affects "extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value", so a headline of "any crafted request" overstates how many apps are reachable. Check anyway: you cannot judge that condition from the outside. ### Is Next.js affected, and which version fixes it? Next.js published a security update on 14 October 2026 for an advisory titled unauthenticated remote code execution in use cache functions returning typed arrays (GHSA-673q-mjm6-r5xr), fixed in 16.4.1 and 15.5.28, and it cites the React advisory as the related upstream advisory. The post does not name CVE-2026-126187 and does not state which earlier Next.js versions are affected. It says there is no known workaround. If you run Next.js with the App Router, move to a fixed version on your line and check your lockfile. ### Is CVE-2026-126187 being exploited? The GitHub advisory does not say. The CVE aggregator cve.now says it is not in CISA KEV and tracks no public exploit code, which is a secondary source and can change quickly, so check CISA KEV again before you rely on it. ### Is this the same as React2Shell (CVE-2025-55182)? No. CVE-2025-55182 was an earlier pre-authentication remote code execution flaw in the same React Server Components packages, disclosed in December 2025 and fixed in 19.0.1, 19.1.2 and 19.2.1. CVE-2026-126187 has different affected and fixed versions (19.0.9, 19.1.10, 19.2.9, 19.3.1), so being patched for the 2025 issue does not mean you are patched for this one. ## Sources - [GitHub Advisory GHSA-xqc2-xf4c-x3h3: React: Unauthenticated Remote Code Execution in React Server Components (published 14 Oct 2026; added to the GitHub Advisory Database 10 Nov 2026)](https://github.com/advisories/GHSA-xqc2-xf4c-x3h3) - [Next.js: Next.js Security Update for Upstream Vulnerabilities (14 October 2026)](https://nextjs.org/blog/nextjs-security-update-october-14-2026) - [Next.js: November 2026 security release (3 November 2026)](https://nextjs.org/blog/november-2026-security-release) - [cve.now: CVE-2026-126187 (secondary aggregator; dates and KEV status per that page, 10 November 2026)](https://cve.now/CVE-2026-126187) - [Auth0 advisory GHSA-4wch-r8cm-c87x for the earlier CVE-2025-55182 (4 December 2025)](https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-4wch-r8cm-c87x) - Not usable: the NVD record returned an empty page when we opened it, and the react.dev blog had no post for this CVE on 11 November 2026.