Skip to content
Breach Index · running record

React vulnerabilities: CVE-2026-126187 and the earlier Server Components flaws (not a breach)

React is the JavaScript library behind a large share of websites, and React Server Components run code on the server. That makes flaws in the react-server-dom packages serious for any app built on a framework that supports them. This page lists the critical advisories and keeps them apart from any claim of a breach.

Short answer

Was React hacked?

No breach of the React project is reported in the sources we read. The 2026 story is a vulnerability: GitHub advisory GHSA-xqc2-xf4c-x3h3 (CVE-2026-126187, CVSS v4 9.5, published 14 October 2026) says crafted payloads sent to frameworks that support React Server Components can lead to remote code execution. It affects react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack from 19.0.0 until the patched releases 19.0.9, 19.1.10, 19.2.9 and 19.3.1.

The advisory says it only affects "extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value", and that apps without server-component support are not affected. It does not say whether the flaw is exploited. An earlier flaw in the same packages, CVE-2025-55182 ("React2Shell"), was fixed in December 2025.

Timeline at a glance

  1. 4 Dec 2025Advisory published for the earlier CVE-2025-55182 in the same packages; fixed in 19.0.1, 19.1.2 and 19.2.1. (Auth0 advisory)Not a breach
  2. 14 Oct 2026React advisory GHSA-xqc2-xf4c-x3h3 published: critical unauthenticated remote code execution, CVSS v4 9.5. (GitHub advisory)Confirmed
  3. 10 Nov 2026The advisory is added to the GitHub Advisory Database; CVE-2026-126187 circulates widely. (GitHub advisory)Confirmed

Last updated 11 November 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

React incident timeline, in detail

Confirmed = acknowledged by React, a regulator filing or a court. Reported = credible reporting React has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Oct 2026Not a breachProduct vulnerability (deserialization, CWE-502)

CVE-2026-126187: critical RCE in React Server Components

What happened. The advisory says crafted payloads targeting frameworks that support React Server Components can lead to remote code execution, in react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack. Affected: 19.0.0 to before 19.0.9, 19.1.0 to before 19.1.10, 19.2.0 to before 19.2.9, 19.3.0 to before 19.3.1. The finder is credited as "evolutionstorm".

Impact. The advisory states no workaround and says updating immediately is recommended. It does not say whether the flaw is exploited. Next.js shipped fixes on 14 October for a related advisory about use cache functions returning typed arrays.

Sources: GitHub advisory GHSA-xqc2-xf4c-x3h3

Dec 2025Not a breachProduct vulnerability

CVE-2025-55182 ("React2Shell"): the earlier pre-authentication RCE

What happened. The Auth0 advisory for the same packages says a pre-authentication remote code execution flaw existed in React Server Components 19.0.0, 19.1.0, 19.1.1 and 19.2.0 and was patched in 19.0.1, 19.1.2 and 19.2.1 (CVSS v3.1 10.0).

Impact. A lockfile fixed for this issue is not fixed for CVE-2026-126187: the patched versions differ.

Sources: Auth0 advisory

Where the reports disagree

  • Dates: GitHub shows the React advisory published 14 October 2026 and listed in its advisory database on 10 November; the CVE aggregator cve.now shows 10 November for both.
  • Packages: GitHub lists three react-server-dom packages; cve.now also lists the react package itself with the same ranges and says 19.0.9 "was never published". We did not check npm; GitHub lists 19.0.9 as patched.
  • Exploitation: the advisory is silent. cve.now says not in CISA KEV and no public exploit tracked, as of its page.

The pattern across the record

The risk sits in the framework layer

The flaw is in packages most teams get through a framework or bundler, so the version that matters is in the lockfile, not the app's own package list.

Vulnerabilities are not breaches

None of the sources reports an intrusion at React. The exposure is to apps that run the affected versions.

What it means for React customers — and what to do

If your apps use Next.js or another framework with React Server Components, check the lockfile now.

  1. 1.Read the lockfile

    Check the resolved react-server-dom-webpack, -turbopack and -parcel versions against the patched list, and your Next.js version against its fixed release.

  2. 2.Update and redeploy

    A fixed lockfile that was never built into the running image changes nothing. Confirm the deployed version.

  3. 3.Prioritise with data

    Check KEV and EPSS and set a deadline.

    Vulnerability prioritizer
  4. 4.Record it

    Log unpatched systems with an owner and a date.

    Risk register

CISO takeaways

Read the news post

Affected and fixed versions, Next.js, and what the viral summary leaves out.

React CVE-2026-126187: our write-up
Check the exploited list

Is it in CISA KEV yet?

KEV checker
Score your dependencies

Ask suppliers how fast they patch framework flaws.

Vendor Risk Scorecard

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed 11 November 2026.

  1. 1.GHSA-xqc2-xf4c-x3h3: React: Unauthenticated RCE in React Server Components — GitHub Advisory Database, 14 Oct 2026
  2. 2.Advisory for CVE-2025-55182 — Auth0 (GitHub), 4 Dec 2025
  3. 3.React blog (no post for CVE-2026-126187 on 11 Nov 2026) — react.dev, 11 Nov 2026

Frequently asked questions

Was React hacked?

No breach of the React project is reported. CVE-2026-126187 is a vulnerability in the React Server Components packages.

Which versions fix CVE-2026-126187?

19.0.9, 19.1.10, 19.2.9 and 19.3.1, one per release line, for the react-server-dom-parcel, -turbopack and -webpack packages.

Is it exploited?

The advisory does not say. cve.now says it is not in CISA KEV; re-check, as that changes quickly.

Is it the same as React2Shell?

No. React2Shell is CVE-2025-55182, fixed in 19.0.1, 19.1.2 and 19.2.1. Different versions fix the 2026 flaw.

Our coverage of React

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Oracle data breachTechnology

Oracle Health, legacy cloud logins and the EBS zero-day.

Salesforce data breachTechnology

Vishing and stolen OAuth tokens across customer tenants.

Workday data breachTechnology

A third-party CRM, business contacts, no tenant access.

Red Hat data breachTechnology

A consulting GitLab and claimed client engagement reports.

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by React. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.