A React Server Components security flaw can let attackers run code remotely without logging in. React published the advisory, tracked as GHSA-xqc2-xf4c-x3h3, on October 14, 2026, and the issue carries a CVSS v4 score of 9.5.
Affected packages and releases
The flaw affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. These packages provide React Server Components support across different build tools. The advisory says exploitation depends on an extremely rare response pattern that involves multiple typed arrays and attacker-controlled data. Simply using React does not make every application vulnerable.
The public description says specially crafted payloads against frameworks that support React Server Components can lead to remote code execution. Typed arrays store numeric data in defined formats. The advisory identifies responses that carry several of these arrays alongside attacker-controlled data as the relevant condition, but it does not publish a full technical breakdown or exploit instructions. It also does not establish how widely that application pattern appears in production.
Risk and limits in the advisory
The severity rating reflects the possible impact despite that narrow requirement. An attacker needs no account privileges, and exploitation requires no user interaction. The advisory rates the possible effects on data privacy, data integrity, and service availability as high. The public notice also gives no claim of active exploitation.
The disclosure follows earlier React security issues covered in Cyber Security News’s reporting on React2Shell exploitation. React2Shell was tracked as CVE-2025-55182, while the October advisory lists no known CVE identifier. Evidence of attacks against the older flaw does not establish exploitation of this newer issue.
Version ranges and fixes
The official React security advisory lists affected releases as 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0 across all three packages. Fixed releases are 19.0.9, 19.1.10, 19.2.9, and 19.3.1. The advisory’s package tables confirm 19.0.9, despite a typo showing “19.0.09” in its patch description.
| Package | Affected versions | Patched versions |
|---|---|---|
| react-server-dom-parcel | 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0 | 19.0.9, 19.1.10, 19.2.9, 19.3.1 |
| react-server-dom-turbopack | 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0 | 19.0.9, 19.1.10, 19.2.9, 19.3.1 |
| react-server-dom-webpack | 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0 | 19.0.9, 19.1.10, 19.2.9, 19.3.1 |
Related guidance from React
React explicitly recommends upgrading affected packages immediately. Applications without server-side React code are not affected, and applications without a framework, bundler, or plugin supporting React Server Components are also outside the advisory’s scope. For this flaw, teams should check installed server-dom package versions against the official affected ranges rather than rely on older patch guidance. Cyber Security News also covered related Next.js vulnerabilities, including a Cache Components issue involving multiple typed arrays.
Licensed under CC BY-ND 4.0 International