Critical React Server Components Flaw Lets Hackers Execute Code Remotely Without Authentication

Cybersecuritynews •Guru Baran • November 9, 2026

A critical security flaw in React Server Components can let attackers run code remotely without logging in. React published the advisory, tracked as GHSA-xqc2-xf4c-x3h3, on October 14, 2026. The issue carries a CVSS v4 score of 9.5, and the React team recommends immediate updates for affected applications. The flaw affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. These […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical React Server Components Vulnerability Enables Remote Code Execution A critical vulnerability, tracked as GHSA-xqc2-xf4c-x3h3, was disclosed on October 14, 2026, affecting React Server Components. This flaw allows unauthenticated attackers to execute remote code on servers using vulnerable versions of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, with a CVSS score of 9.5. The affected versions span from 19.0.0 to 19.3.0. React's advisory emphasizes that exploitation conditions are rare but recommends immediate updates to fixed versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1. There are no known CVE identifiers associated with this vulnerability, which may hinder detection by security scanners. As of November 8, 2026, no exploitation in the wild has been reported. React also published a related advisory for a denial-of-service vulnerability on the same day, which is rated 8.2 on the CVSS scale. 5 sources 71

Extracted Entities

Critical React Server Components Flaw Lets Hackers Execute Code Remotely Without Authentication

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Vulnerabilities (1)