Unauthenticated RCE in React Server Components (GHSA-xqc2-xf4c-x3h3), CVSS 9.5, patched in React 19.0.9/19.1.10/19.2.9/19.3.1
React maintainers published advisory GHSA-xqc2-xf4c-x3h3 on 14 October 2026, describing an unauthenticated remote code execution condition in React Server Components rated CVSS v4.0 9.5 (critical). The flaw is reachable over the network without privileges or user interaction, but the vector explicitly marks Attack Requirements: Present, and the maintainers state the triggering conditions are extremely rare: responses that transport multiple typed arrays together with an attacker-controlled value. Three npm packages carry the vulnerable code — react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack — in versions 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8 and 19.3.0. The GitHub advisory lists no CVE ID and no CWE classification, and no exploitation in the wild is claimed. Client-only React applications, and applications without a framework, bundler or bundler plugin supporting React Server Components, are outside the stated scope.
Entenda a falha
A vulnerabilidade
GHSA-xqc2-xf4c-x3h3 (no CVE, no CWE) is an unauthenticated remote code execution flaw in React Server Components, rated CVSS v4.0 9.5. It is reachable over the network with no privileges or user interaction, but the vector marks Attack Requirements as present, and the maintainers say the triggering conditions are extremely rare. Affected are react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack 19.0.0-19.0.8, 19.1.0-19.1.9, 19.2.0-19.2.8 and 19.3.0, plus Next.js 16.0.0-16.4.0. Fixed in 19.0.9, 19.1.10, 19.2.9 and 19.3.1, and in Next.js 16.4.1. Client-only apps and apps without RSC support are out of scope.
Como funciona
The advisory does not publish an exploitation sequence. What is stated is that a crafted payload sent to a framework supporting React Server Components can lead to code execution when a response carries multiple typed arrays together with an attacker-controlled value. The exact step where processing goes wrong is not described. The impact ratings are high on the vulnerable server and high for confidentiality and integrity on subsequent systems.
Por que é vulnerável
The advisory does not name the underlying coding error and assigns no CWE, so the root cause is not public. The fix was shipped directly in released package versions, without a public pull request or commit, so what it changes cannot be described from the sources.
Onde está
The vulnerable code is in the react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack packages; no file, function or public commit is named.
Como foi descoberta
The articles do not say who found the flaw or how. React maintainers published the advisory on 14 October 2026, and no exploitation in the wild is claimed. Next.js released 16.4.1 with the patched React copies about nine hours later, alongside its own cache-related RCE advisory, GHSA-673q-mjm6-r5xr.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 04:17.
Detalhes técnicos
The advisory does not publish an exploitation sequence or name the underlying coding error. The CVSS assessment reports high confidentiality, integrity and availability impact on the vulnerable system, and high confidentiality and integrity — but no availability — impact on subsequent systems. The dependency scope is defined by the three server-DOM package versions rather than by the presence of React itself, so inventories must be built from resolved package versions, not from the React major release. The same three packages hosted React2Shell (CVE-2025-55182), a separate and earlier React Server Components RCE; its identifiers, affected ranges and patch guidance do not apply here. A React Server Components denial-of-service issue disclosed previously concerns resource exhaustion and is likewise a distinct advisory — releases fixed for those earlier issues can still fall inside this advisory's affected ranges.
Detalhes da correção
The advisory does not point to a public pull request or commit; React's security fix was shipped directly in released artifacts. Fixed versions are 19.0.9, 19.1.10, 19.2.9 and 19.3.1 across all three packages. Next.js shipped the patched React copies bundled in 16.4.1, released roughly nine hours after the React advisory, alongside its own cache-related RCE advisory GHSA-673q-mjm6-r5xr affecting Next.js 16.0.0–16.4.0 with Cache Components enabled where a use cache function returns more than one typed array (thehackernews.com, github.com).
Remediação
Upgrade react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack to 19.0.9 / 19.1.10 / 19.2.9 / 19.3.1 on the matching branch. Verify the resolved versions in lockfiles and in production build artifacts, since transitive pins and bundler-vendored copies may keep vulnerable code in place, then rebuild and redeploy so the corrected code actually reaches running servers. Next.js App Router deployments should move to 16.4.1 or later (thehackernews.com).
Linha do tempo
-
Unauthenticated RCE in React Server Components (GHSA-xqc2-xf4c-x3h3), CVSS 9.5, patched in React 19.0.9/19.1.10/19.2.9/19.3.1
ler a análise desta fonte ocultar
React maintainers published advisory GHSA-xqc2-xf4c-x3h3 on 14 October 2026, describing an unauthenticated remote code execution condition in React Server Components rated CVSS v4.0 9.5 (critical). The flaw is reachable over the network without privileges or user interaction, but the vector explicitly marks Attack Requirements: Present, and the maintainers state the triggering conditions are extremely rare: responses that transport multiple typed arrays together with an attacker-controlled value. Three npm packages carry the vulnerable code — react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack — in versions 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8 and 19.3.0. The GitHub advisory lists no CVE ID and no CWE classification, and no exploitation in the wild is claimed. Client-only React applications, and applications without a framework, bundler or bundler plugin supporting React Server Components, are outside the stated scope.
Technical Details
The advisory does not publish an exploitation sequence or name the underlying coding error. The CVSS assessment reports high confidentiality, integrity and availability impact on the vulnerable system, and high confidentiality and integrity — but no availability — impact on subsequent systems. The dependency scope is defined by the three server-DOM package versions rather than by the presence of React itself, so inventories must be built from resolved package versions, not from the React major release. The same three packages hosted React2Shell (CVE-2025-55182), a separate and earlier React Server Components RCE; its identifiers, affected ranges and patch guidance do not apply here. A React Server Components denial-of-service issue disclosed previously concerns resource exhaustion and is likewise a distinct advisory — releases fixed for those earlier issues can still fall inside this advisory's affected ranges.
Fix Details
The advisory does not point to a public pull request or commit; React's security fix was shipped directly in released artifacts. Fixed versions are 19.0.9, 19.1.10, 19.2.9 and 19.3.1 across all three packages. Next.js shipped the patched React copies bundled in 16.4.1, released roughly nine hours after the React advisory, alongside its own cache-related RCE advisory GHSA-673q-mjm6-r5xr affecting Next.js 16.0.0–16.4.0 with Cache Components enabled where a
use cachefunction returns more than one typed array (thehackernews.com, github.com).Remediation
Upgrade react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack to 19.0.9 / 19.1.10 / 19.2.9 / 19.3.1 on the matching branch. Verify the resolved versions in lockfiles and in production build artifacts, since transitive pins and bundler-vendored copies may keep vulnerable code in place, then rebuild and redeploy so the corrected code actually reaches running servers. Next.js App Router deployments should move to 16.4.1 or later (thehackernews.com).