CVE-2026-126187: Unauthenticated Remote Code Execution in React Server Components

Vulnerability ID: CVE-2026-126187
CVSS Score: 9.5
Published: 2026-11-10

A critical deserialization vulnerability exists in React Server Components (RSC) packages (react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack) across versions 19.0.0 through 19.3.0. The flaw occurs during the processing of React Flight protocol streams when handling multiple typed arrays sharing a backing ArrayBuffer alongside attacker-controlled inputs. By combining byte-stream buffer detachment semantics with unvalidated thenable invocation and exposed internal response states, an unauthenticated attacker can achieve remote code execution on server runtimes supporting React Server Components.

TL;DR

React Server Components packages in the 19.x release branches are vulnerable to unauthenticated remote code execution (CVSS v4.0 9.5) via crafted Flight payloads when transporting multiple typed arrays and untrusted values. Users must upgrade to versions 19.0.9, 19.1.10, 19.2.9, or 19.3.1 immediately.

Technical Details

• CVE ID: CVE-2026-126187 (GHSA-xqc2-xf4c-x3h3)
• Weakness Class: CWE-502: Deserialization of Untrusted Data
• CVSS v4.0 Score: 9.5 Critical (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N)
• Attack Vector: Network (Unauthenticated HTTP Flight / RSC Payloads)
• Impact: Unauthenticated Remote Code Execution (RCE)
• Affected Packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack
• Patched Versions: 19.0.9, 19.1.10, 19.2.9, 19.3.1
• CISA KEV Status: Not Listed

Affected Systems

• react-server-dom-webpack
• react-server-dom-parcel
• react-server-dom-turbopack
• react-server-dom-webpack: >= 19.0.0, < 19.0.9 (Fixed in: 19.0.9)
• react-server-dom-webpack: >= 19.1.0, < 19.1.10 (Fixed in: 19.1.10)
• react-server-dom-webpack: >= 19.2.0, < 19.2.9 (Fixed in: 19.2.9)
• react-server-dom-webpack: >= 19.3.0, < 19.3.1 (Fixed in: 19.3.1)
• react-server-dom-parcel: >= 19.0.0, < 19.0.9 (Fixed in: 19.0.9)
• react-server-dom-parcel: >= 19.1.0, < 19.1.10 (Fixed in: 19.1.10)
• react-server-dom-parcel: >= 19.2.0, < 19.2.9 (Fixed in: 19.2.9)
• react-server-dom-parcel: >= 19.3.0, < 19.3.1 (Fixed in: 19.3.1)
• react-server-dom-turbopack: >= 19.0.0, < 19.0.9 (Fixed in: 19.0.9)
• react-server-dom-turbopack: >= 19.1.0, < 19.1.10 (Fixed in: 19.1.10)
• react-server-dom-turbopack: >= 19.2.0, < 19.2.9 (Fixed in: 19.2.9)
• react-server-dom-turbopack: >= 19.3.0, < 19.3.1 (Fixed in: 19.3.1)

Code Analysis

Commit: 61aa00d

Harden Flight deserialization, encapsulate Response reason behind RESPONSE_SYMBOL, validate bound arguments, and prevent detached buffer transport.

Commit: 0c9913a

Backport Flight deserialization and TypedArray stream buffer detachment fixes.

Commit: 249ac87

Backport Flight security hardening to supported 19.x release branch.

Commit: 3d06b40

Backport Flight security hardening to supported 19.x release branch.

Commit: 611d921

Backport Flight security hardening to supported 19.x release branch.

Mitigation Strategies

• Upgrade react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack to patched releases across all deployment environments.
• Audit lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) using dependency inspection tools to ensure meta-frameworks do not pull in transitive vulnerable versions.
• Clone partial TypedArray views using .slice() before returning them from React Server Components or Server Actions to prevent shared ArrayBuffer detachment.
• Ensure server-side JavaScript runtimes (Node.js, Deno, Bun, Edge) are updated to versions supporting ArrayBuffer.prototype.detached.

Remediation Steps:

1. Identify affected packages by running npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack.
2. Update the relevant react-server-dom-* package to 19.0.9, 19.1.10, 19.2.9, or 19.3.1 matching your current minor release channel.
3. If a meta-framework pins a vulnerable version, add an overrides (npm/pnpm) or resolutions (Yarn) entry in package.json forcing the patched version.
4. Rebuild and redeploy the server application to ensure updated server bundle artifacts are active.

References

• CVE-2026-126187 Official CVE Record
• GitHub Security Advisory GHSA-xqc2-xf4c-x3h3
• React Fix Commit 61aa00df822d0eb76d0362eb8b6fdd3527693efe
• React Fix Commit 0c9913ae87283f96e868a8f1c20a3389827632d0
• React Pull Request #37842
• React Pull Request #37843
• React Pull Request #37844
• React Pull Request #37845
• React Pull Request #37846

Read the full report for CVE-2026-126187 on our website for more details including interactive diagrams and full exploit analysis.