React Server Components Flaw Allows Unauthenticated RCE (CVE-2026-126187)

What happened

React disclosed an unauthenticated remote code execution vulnerability (CVE-2026-126187) affecting the server-side React Server Components (RSC) rendering packages: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. According to the GitHub Security Advisory, crafted payloads sent to frameworks that support RSC can trigger RCE, but React characterizes this as an "extremely rare" condition requiring responses that transport multiple typed arrays alongside an attacker-controlled value.

Affected version ranges are 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, and 19.3.0. Fixes have been backported to 19.0.9, 19.1.10, 19.2.9, and 19.3.1. A public PoC is reported to exist for this issue.

Why it matters

Any app using one of the three affected packages — i.e., any framework, bundler, or bundler plugin that implements server-side rendering of React Server Components — is potentially exposed to unauthenticated RCE on the server. Apps that only use React client-side, or that don't use a framework/bundler with RSC support, are not affected per the advisory. Given the breadth of the React ecosystem and that this touches the server runtime rather than client code, exposure could span a wide range of production Node.js services, and public PoC availability raises the urgency for rapid patching.

What defenders should do now

• Inventory any Node.js/server applications using react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack, and check installed versions against the affected ranges.
• Upgrade immediately to the patched releases (19.0.9, 19.1.10, 19.2.9, or 19.3.1) — React's advisory frames this as urgent.
• At a high level, hunt for anomalous RSC payloads containing multiple typed-array-encoded values in request bodies to RSC-serving endpoints, and watch for unexpected child-process spawning or unusual outbound connections originating from Node.js processes hosting React SSR/RSC workloads.
• Review WAF/reverse-proxy logs for unusual payload shapes on routes known to serve React Server Component responses, and consider temporary payload-size/structure restrictions on those endpoints until patched.

Developing intel

This is a same-day advisory and details may evolve as the community analyzes the vulnerability and any public proof-of-concept further. Treat the specifics above as preliminary. For authoritative details and updates, see the original GitHub Security Advisory: GHSA-xqc2-xf4c-x3h3.