React Server Components flaw allows unauthenticated remote code execution

The GitHub advisory for CVE-2026-126187 rates the deserialization flaw critical and warns that crafted payloads sent to applications supporting React Server Components may permit unauthenticated remote code execution. The advisory is tracked as GHSA-xqc2-xf4c-x3h3. The affected npm packages are the webpack, Parcel and Turbopack editions of react-server-dom. According to the advisory, the bug can be triggered only in rare responses that deliver more than one typed array alongside a value controlled by an attacker. It does not affect applications that do not use a server or React Server Components. Client-only React applications and server-rendered React applications that do not use React Server Components are therefore not affected.

The vulnerable lines cover releases earlier than 19.0.9 in the 19.0 series, earlier than 19.1.10 in 19.1, earlier than 19.2.9 in 19.2, and the single 19.3.0 release. Patched releases 19.0.9, 19.1.10, 19.2.9 and 19.3.1 close the hole, and the advisory urges immediate updating. All three affected packages share the same vulnerable ranges and patched versions. GitHub classifies the weakness as CWE-502, deserialization of untrusted data. That weakness arises when serialized data from an untrusted source is deserialized without sufficient validation.

The CVSS v4 vector lists a network attack vector, so an attacker does not need local access. Attack complexity is low, and the advisory lists attack requirements as present. No privileges and no user interaction are required. The vulnerable system's confidentiality, integrity and availability impact are all high. For the subsequent system, confidentiality and integrity impact are high, while availability impact is none. The advisory credits GitHub user evolutionstorm as the finder.

GitHub published the advisory on Nov. 10, 2026 and reviewed it the same day. It says the issue was first published by mattcarrollcode in the react/react repository on Oct. 14, 2026, roughly four weeks before the Nov. 10 advisory. Developers can check whether their installed react-server-dom versions fall within these ranges and move to the patched releases.