Critical React Server Components Vulnerability Allows Unauthenticated Attackers to ...

A serious vulnerability in React Server Components may enable unauthenticated attackers to execute malicious code on affected servers. The advisory, released on October 14, 2026, assigns the issue a CVSS v4.0 score of 9.5.

React maintainers advise that users update their systems immediately, though they emphasize that the conditions necessary for exploitation are extremely rare.

According to the official security advisory , tracked as GHSA-xqc2-xf4c-x3h3, crafted payloads targeting frameworks supporting React Server Components can trigger remote code execution. The vulnerable condition involves responses that transport multiple typed arrays along with an attacker-controlled value. The advisory does not disclose a detailed exploitation sequence or identify the underlying coding error.

React Server Components Vulnerability

The vulnerability affects three npm packages: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. Vulnerable releases span versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0. These package versions, rather than React’s presence alone, define the dependency scope the maintainers identified.

The CVSS assessment describes a network-accessible attack requiring neither privileges nor user interaction. Although attack complexity is rated low, the vector explicitly marks additional attack requirements as present. This distinction matters: a critical severity rating does not mean every application running an affected package automatically exposes a usable exploitation path.

Successful exploitation could severely affect the vulnerable system’s confidentiality, integrity, and availability. The assessment also identifies high confidentiality and integrity impacts on subsequent systems, but no subsequent availability impact. These ratings describe potential consequences; the advisory does not establish that attackers have achieved those outcomes in production environments.

Earlier reporting on React2Shell remote code execution covered CVE-2025-55182, a separate vulnerability involving React Server Components. Administrators should not reuse that issue’s identifiers, affected-version lists, or original patch guidance for this advisory. The current GitHub entry lists no known CVE identifier and provides no assigned CWE classification.

Maintainers list fixed versions as 19.0.9, 19.1.10, 19.2.9, and 19.3.1 across all three affected packages. Organizations should upgrade vulnerable dependencies immediately. As a deployment precaution, teams should verify resolved package versions in lockfiles and production artifacts, then rebuild and redeploy applications so the corrected code actually reaches running servers.

The disclosure follows other server-side React issues, including a React Server Components denial-of-service vulnerability . However, that earlier issue concerns resource exhaustion, not this advisory’s code-execution condition. Treating separate disclosures as interchangeable can leave deployments incorrectly assessed, especially when earlier fixed releases remain within a newer vulnerability’s affected ranges.

Client-only React applications are unaffected. Applications without a framework, bundler, or bundler plugin supporting React Server Components are also outside the stated scope.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs .

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

PolinRider Malware Returns in 10 Hijacked npm Packages Using Ethereum Blockchain to Deliver Malicious Code

A concealed JavaScript loaders in 12 releases across 10 hijacked npm packages, linking the compromise…

SonicWall Warns of Actively Exploited SSL-VPN Vulnerability That Bypasses SAML and MFA Protection

SonicWall has urged customers to address an SSL-VPN authentication vulnerability that can bypass SAML controls,…

NVIDIA Investigates Suspected Foreign Espionage Campaign Targeting CEO Jensen Huang

NVIDIA has initiated an independent investigation into reports suggesting that foreign intelligence may have targeted…

Anthropic’s Claude AI Deletes a Year of Law Professor’s Lecture Notes During Simple Editing Task

University of Chicago law professor William Baude says Anthropic’s Claude AI deleted his current syllabus…

NotC2 AI-Powered Hacking Tool Turns Amazon Bedrock Into a Cloud Command-and-Control System

NotC2, a proof-of-concept framework that combines legitimate AWS services with Amazon Bedrock to run post-compromise…

Anthropic Claude Code’s ‘Don’t Ask Again’ Feature Exposes 2,539 Secrets on GitHub

Apiiro researchers Shmulik Cohen and Matan Giladi identified 2,539 distinct secrets across 1,994 public GitHub…