React: Unauthenticated Remote Code Execution in React Server Components

react

Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Updating immediately is recommended.

Do this now

Check the vendor's advisory for a fix, restrict access to affected React Server Components endpoints, and limit exposure until one is confirmed.

Who should check: teams running React or npm packages

First seen: 10 Nov 2026
Last update: 12 Nov 2026, 15:17 UTC
Versions per GitHub advisory, not the vendor: react-server-dom-parcel 19.3.1
react-server-dom-parcel 19.2.9
react-server-dom-parcel 19.1.10
react-server-dom-parcel 19.0.9
react-server-dom-turbopack 19.3.1
react-server-dom-turbopack 19.2.9
react-server-dom-turbopack 19.1.10
react-server-dom-turbopack 19.0.9
react-server-dom-webpack 19.3.1
react-server-dom-webpack 19.2.9
react-server-dom-webpack 19.1.10
react-server-dom-webpack 19.0.9
Identifiers: CVE-2026-126187
CVSS: 9.5
Source: GitHub advisory
On the menu as: React
npm packages

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## React: Unauthenticated Remote Code Execution in React Server Components
Severity: critical. Patch status: fix status unknown.
Affected: react
Versions per GitHub advisory, not the vendor: react-server-dom-parcel 19.3.1, react-server-dom-parcel 19.2.9, react-server-dom-parcel 19.1.10, react-server-dom-parcel 19.0.9, react-server-dom-turbopack 19.3.1, react-server-dom-turbopack 19.2.9, react-server-dom-turbopack 19.1.10, react-server-dom-turbopack 19.0.9, react-server-dom-webpack 19.3.1, react-server-dom-webpack 19.2.9, react-server-dom-webpack 19.1.10, react-server-dom-webpack 19.0.9
Ids: CVE-2026-126187

Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Updating immediately is recommended.

## Steps
1. Search every lockfile and manifest (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock, composer.lock, go.sum, Cargo.lock, Gemfile.lock) for `react-server-dom-parcel`, `react-server-dom-turbopack`, `react-server-dom-webpack`. For each hit, compare the installed version with the version on the same major line (per GitHub advisory, not the vendor, so check the vendor's advisory before treating it as a fix): react-server-dom-parcel 19.3.1, react-server-dom-parcel 19.2.9, react-server-dom-parcel 19.1.10, react-server-dom-parcel 19.0.9, react-server-dom-turbopack 19.3.1, react-server-dom-turbopack 19.2.9, react-server-dom-turbopack 19.1.10, react-server-dom-turbopack 19.0.9, react-server-dom-webpack 19.3.1, react-server-dom-webpack 19.2.9, react-server-dom-webpack 19.1.10, react-server-dom-webpack 19.0.9. If it's lower, give the exact upgrade command for the package manager this repo uses.
2. Versions per GitHub advisory, not the vendor: react-server-dom-parcel: 19.3.x → 19.3.1; 19.2.x → 19.2.9; 19.1.x → 19.1.10; 19.0.x → 19.0.9. react-server-dom-turbopack: 19.3.x → 19.3.1; 19.2.x → 19.2.9; 19.1.x → 19.1.10; 19.0.x → 19.0.9. react-server-dom-webpack: 19.3.x → 19.3.1; 19.2.x → 19.2.9; 19.1.x → 19.1.10; 19.0.x → 19.0.9. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| react-server-dom-parcel 19.3.x | per GitHub advisory, not the vendor | 19.3.1 | restrict network access to it |
| react-server-dom-parcel 19.2.x | per GitHub advisory, not the vendor | 19.2.9 | restrict network access to it |
| react-server-dom-parcel 19.1.x | per GitHub advisory, not the vendor | 19.1.10 | restrict network access to it |
| react-server-dom-parcel 19.0.x | per GitHub advisory, not the vendor | 19.0.9 | restrict network access to it |
| react-server-dom-turbopack 19.3.x | per GitHub advisory, not the vendor | 19.3.1 | restrict network access to it |
| react-server-dom-turbopack 19.2.x | per GitHub advisory, not the vendor | 19.2.9 | restrict network access to it |
| react-server-dom-turbopack 19.1.x | per GitHub advisory, not the vendor | 19.1.10 | restrict network access to it |
| react-server-dom-turbopack 19.0.x | per GitHub advisory, not the vendor | 19.0.9 | restrict network access to it |
| react-server-dom-webpack 19.3.x | per GitHub advisory, not the vendor | 19.3.1 | restrict network access to it |
| react-server-dom-webpack 19.2.x | per GitHub advisory, not the vendor | 19.2.9 | restrict network access to it |
| react-server-dom-webpack 19.1.x | per GitHub advisory, not the vendor | 19.1.10 | restrict network access to it |
| react-server-dom-webpack 19.0.x | per GitHub advisory, not the vendor | 19.0.9 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-126187") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/advisories/GHSA-xqc2-xf4c-x3h3 https://github.com/react/react/pull/37842 https://github.com/react/react/pull/37843 https://github.com/react/react/pull/37844 https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3 https://www.stepsecurity.io/blog/cve-2026-126187-react-flight-rce
https://pwned.coffee/i/react-unauthenticated-remote-code-execution-in-react-ser-cve-2026-126187

Timeline

12 Nov 2026, 15:17 UTC
Reported by stepsecurity.io: CVE-2026-126187: React Server Components Flaw Lets Attackers Execute Code Through Smuggled Flight Rows
10 Nov 2026, 23:18 UTC
Fix status: patched → unknown.
10 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
By release line, per GitHub advisory, not the vendor: Product Affected Version named Source
react-server-dom-parcel (npm) >= 19.3.0, < 19.3.1 19.3.1 GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-parcel (npm) >= 19.2.0, < 19.2.9 19.2.9 GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-parcel (npm) >= 19.1.0, < 19.1.10 19.1.10 GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-parcel (npm) >= 19.0.0, < 19.0.9 19.0.9 GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-turbopack (npm) >= 19.3.0, < 19.3.1 19.3.1 GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-turbopack (npm) >= 19.2.0, < 19.2.9 19.2.9 GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-turbopack (npm) >= 19.1.0, < 19.1.10 19.1.10 GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-turbopack (npm) >= 19.0.0, < 19.0.9 19.0.9 GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-webpack (npm) >= 19.3.0, < 19.3.1 19.3.1 GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-webpack (npm) >= 19.2.0, < 19.2.9 19.2.9 GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-webpack (npm) >= 19.1.0, < 19.1.10 19.1.10 GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-webpack (npm) >= 19.0.0, < 19.0.9 19.0.9 GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
Score: CVSS 9.5 (critical). CVSS 4.0 9.5 (CNA GitHub_M) for CVE-2026-126187
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Version named	Source
react-server-dom-parcel (npm)	>= 19.3.0, < 19.3.1	19.3.1	GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-parcel (npm)	>= 19.2.0, < 19.2.9	19.2.9	GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-parcel (npm)	>= 19.1.0, < 19.1.10	19.1.10	GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-parcel (npm)	>= 19.0.0, < 19.0.9	19.0.9	GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-turbopack (npm)	>= 19.3.0, < 19.3.1	19.3.1	GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-turbopack (npm)	>= 19.2.0, < 19.2.9	19.2.9	GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-turbopack (npm)	>= 19.1.0, < 19.1.10	19.1.10	GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-turbopack (npm)	>= 19.0.0, < 19.0.9	19.0.9	GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-webpack (npm)	>= 19.3.0, < 19.3.1	19.3.1	GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-webpack (npm)	>= 19.2.0, < 19.2.9	19.2.9	GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-webpack (npm)	>= 19.1.0, < 19.1.10	19.1.10	GitHub advisory per GitHub advisory, not the vendor checked 13 Nov
react-server-dom-webpack (npm)	>= 19.0.0, < 19.0.9	19.0.9	GitHub advisory per GitHub advisory, not the vendor checked 13 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Follow on X

Totalone very hot coffee