Skip to content
Critical React Server Components Vulnerability Enables Remote Code Execution

Critical React Server Components Vulnerability Enables Remote Code Execution

First seen 9 Nov 2026, 02:18 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 9, 2026 at 09:20 UTC
  • •The vulnerability GHSA-xqc2-xf4c-x3h3 allows unauthenticated remote code execution.
  • •Affected packages include react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.
  • •Immediate updates to fixed versions are recommended, as no exploitation has been confirmed yet.

A critical vulnerability, tracked as GHSA-xqc2-xf4c-x3h3, was disclosed on October 14, 2026, affecting React Server Components. This flaw allows unauthenticated attackers to execute remote code on servers using vulnerable versions of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, with a CVSS score of 9.5. The affected versions span from 19.0.0 to 19.3.0. React's advisory emphasizes that exploitation conditions are rare but recommends immediate updates to fixed versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1. There are no known CVE identifiers associated with this vulnerability, which may hinder detection by security scanners. As of November 8, 2026, no exploitation in the wild has been reported. React also published a related advisory for a denial-of-service vulnerability on the same day, which is rated 8.2 on the CVSS scale.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1d ago How this analysis works

Timeline

2026-10-14
GHSA-xqc2-xf4c-x3h3 advisory published
React disclosed a critical RCE vulnerability affecting several packages, advising immediate updates.
Brandefense
2026-11-08
No exploitation reported
As of this date, no public reports of exploitation in the wild have been found for the vulnerability.
Brandefense

More articles in this cluster (6)

Following this threat?

Track React2Shell and CVE-2025-55182 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 2

Common questions

Which versions are affected?
Versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0 are affected.
What should I do if I'm affected?
Upgrade to fixed versions 19.0.9, 19.1.10, 19.2.9, or 19.3.1 immediately.
Is there any known exploitation of this vulnerability?
No, as of November 8, 2026, there are no confirmed reports of exploitation in the wild.