CVE-2026-126187: React Server Components Unauthenticated Remote Code Execution Fixed in 19.3.1

by Nam Phong · November 11, 2026

React Server Components security update for CVE-2026-126187 unauthenticated remote code execution

TL;DR

Maintainers of the React library fixed a critical unauthenticated remote code execution bug in React Server Components. Tracked as CVE-2026-126187 (CVSS 9.5), the flaw hits server DOM packages when responses send multiple typed arrays with an attacker value. Devs using server React tools must update to version 19.3.1 or the newest patched build right away.

Why It Matters

React Server Components power server rendering and data tasks for modern web tools like Next.js. Because the bug needs no login password, exposed web hosts that use this path face full takeover risks.

Security researcher evolutionstorm reported the flaw to the React team. Currently, neither the React report nor MITRE confirms active attacks in the wild or verified public exploit code. While only rare setups trigger the bug, coders pull these server packages millions of times per week on npm.

How the Attack Works

Untrusted Data Deserialization

First, the bug stems from unsafe data handling (CWE-502) in the React Flight bindings. The error happens when a server response sends multiple typed arrays along with an attacker-controlled value. Consequently, a remote attacker can send a crafted payload that breaks stream parsing and runs code on the server.

Affected Versions

CVE-2026-126187 hits the npm packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. Affected builds include versions 19.0.0 to 19.0.8, 19.1.0 to 19.1.9, 19.2.0 to 19.2.8, and 19.3.0. In contrast, browser-only apps that do not use a server or React Server Components are safe.

Patch and Mitigation Steps

The React team fixed the flaw in versions 19.3.1, 19.2.9, 19.1.10, and 19.0.9. Devs must update react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack to these fixed builds right away. Teams using frameworks like Next.js with Cache Components should also update their framework packages to pull in the patch.