React Server Components flaw prompts immediate patching
A React Server Components security flaw can let attackers run code remotely without logging in. React published the advisory, tracked as GHSA-xqc2-xf4c-x3h3, on October 14, 2026, and the issue carries a CVSS v4 score of 9.5. Affected packages and releases The flaw affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. These packages provide React Server Components support across different build tools. The advisory says exploitation depends on an extremely rare response pattern that…