React Server Components RCE CVE-2026-126187 (CVSS 9.5): Fixed Quietly in October, CVE Published 10 November — Update react-server-dom Packages to 19.0.9, 19.1.10, 19.2.9 or 19.3.1

Critical · 2026-11-12 · By H.A

An unauthenticated deserialization flaw in React's Flight protocol can give remote code execution on servers running React Server Components when typed arrays share a buffer, and because the CVE arrived weeks after the fix, many builds remain unpatched.

Overview

The React team has fixed CVE-2026-126187, an unauthenticated remote code execution flaw in React Server Components (RSC) rated CVSS 9.5 (CVSS v4). It affects the server-side Flight packages react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel across the React 19 line. The fixes shipped quietly in October, and the CVE and public advisory were only assigned and indexed on 10 November 2026. Many teams may therefore not yet realise their production builds are affected.

No exploitation has been reported, and the flaw is not in CISA's KEV catalog. Trackers disagree on whether proof-of-concept code is public. React's December 2025 RSC flaw was weaponised within days of disclosure, so this one deserves the same urgency.

The Vulnerability

The bug is classed as deserialization of untrusted data (CWE-502) in the Flight protocol, which RSC uses to stream data between client and server. According to the advisory, a crafted payload sent to a server running RSC can achieve code execution. It applies in an "extremely rare" case: when responses carry multiple typed arrays together with an attacker-controlled value. The CVSS vector reflects this with "attack requirements present", but no authentication or user interaction is needed.

Technical analyses of the patch describe two parts:

• Buffer handling: when several typed-array views share one ArrayBuffer, writing a large view can detach the buffer. Later chunks are then corrupted and the Flight parser loses sync.
• Unsafe values in the reply parser: untrusted "bound" values could be treated as promise-like objects or applied as function arguments without type checks, giving an attacker a path from a malformed stream to code execution.

The fixes reject promise-like values, require bound arguments to be genuine arrays, hide the internal response object, clone views that span shared buffers and throw on detached buffers.

Affected and fixed versions (all three packages):

• 19.0.0–19.0.8 → fixed in 19.0.9
• 19.1.0–19.1.9 → fixed in 19.1.10
• 19.2.0–19.2.8 → fixed in 19.2.9
• 19.3.0 → fixed in 19.3.1

Apps are not affected if their React code does not run on a server, or does not use a framework, bundler or bundler plugin that supports Server Components. Frameworks such as Next.js bundle or pin these packages, so check the resolved version, not just the version in your package.json.

Timeline

• 14 October 2026: React publishes the fix and its repository advisory.
• 10 November 2026: CVE-2026-126187 is assigned and the advisory is added to the GitHub Advisory Database.
• 11 November 2026: no confirmed in-the-wild exploitation; not listed in CISA KEV.

Tradecraft

No attacks have been reported. Expect the pattern seen with earlier RSC flaws:

• internet-wide scanning for RSC and Next.js endpoints, identified by Flight content types and RSC / Next-Action request headers;
• crafted POST requests carrying malformed Flight payloads;
• after a successful compromise, theft of environment variables (cloud keys, database URLs, API tokens), crypto-miners, and backdoors in serverless functions or containers.

The October fix date gives attackers a month-long head start for diffing the patch. The trigger is narrow, but its preconditions can be met in real applications.

Detection

Find vulnerable versions in each project:

npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel
pnpm why react-server-dom-webpack
yarn why react-server-dom-webpack

Check container images and lockfiles in CI, for example by grepping package-lock.json, pnpm-lock.yaml or yarn.lock for the package names and versions below the fixed releases.

At runtime, watch for:

• unusually large or malformed POST bodies to Server Action or RSC endpoints;
• Node.js processes running shells (sh, bash, curl, wget) or making unexpected outbound connections;
• sudden reads of environment variables or secrets files from the web process.

Recommended Actions

1. Upgrade the react-server-dom-* packages to 19.0.9, 19.1.10, 19.2.9 or 19.3.1, depending on your branch, then redeploy. Patching the lockfile is not enough until new builds are live.
2. Where a framework pins an old version, use npm overrides or yarn/pnpm resolutions to force the fixed release until the framework ships an update.
3. Check every running service, including preview deployments, internal tools and serverless functions, not just the main site.
4. Apply WAF rules from your CDN or WAF provider for malformed RSC/Flight payloads as a temporary layer, not a substitute for patching.
5. Run RSC servers with least privilege and keep long-lived cloud credentials out of their environment variables. Rotate secrets if you find signs of tampering.

Analyst Assessment

We rate this Critical. The bug needs specific data shapes, which lowers the odds that any given application is exploitable. But RSC is now the default in popular frameworks, and the fix sat unannounced for almost four weeks. Last year's RSC vulnerability showed how quickly attackers move against Server Components once a CVE gives them a target. Teams that pin frameworks and rarely rebuild are most at risk. Make the dependency check a same-day task.