Critical React Server Components security flaw Allows Unauthenticated Attackers to Execute Malicious Code on Servers

What happened

The advisory, released on October 14, 2026, assigns the issue a CVSS v4.0 score of 9.5. The advisory does not disclose a detailed exploitation sequence or identify the underlying coding error.

Vulnerable releases span versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0. These package versions, rather than React’s presence alone, define the dependency scope the maintainers identified.

A serious vulnerability in React Server Components may enable unauthenticated attackers to execute malicious code on affected servers. React maintainers advise that users update their systems immediately, though they emphasize that the conditions necessary for exploitation are extremely rare.

CVE/vulnerability Cyber Security News Vulnerability 2 min.

According to the official security advisory , tracked as GHSA-xqc2-xf4c-x3h3, crafted payloads targeting frameworks supporting React Server Components can trigger remote code execution (running programs on a machine from somewhere else).

The vulnerable condition involves responses that transport multiple typed arrays along with an attacker-controlled value. React Server Components Vulnerability The vulnerability affects three npm packages: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.