GHSA-xqc2-xf4c-x3h3: React: Unauthenticated Remote Code Execution in React Server Components

Q: Which applications are actually affected?

Affected applications use react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack in the listed vulnerable versions and use a framework, bundler, or bundler plugin that supports React Server Components. Applications whose React code does not use a server, or that do not use React Server Components support, are not affected.

Q: What conditions are needed for exploitation?

An attacker must be able to send a crafted payload to a vulnerable React Server Components implementation. The affected response must transport multiple typed arrays and include an attacker-controlled value; the advisory describes these cases as extremely rare.

Q: Which versions should be used to remediate the issue?

Upgrade the affected package to 19.0.09, 19.1.10, 19.2.9, or 19.3.1. The vulnerable releases are 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0.

Published Nov 10, 2026

Updated

Impact

Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value.

Updating immediately is recommended.

The vulnerability exists in versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8 and 19.3.0 of:

- react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack

Patches

Fixes were back ported to versions 19.0.09, 19.1.10, 19.2.9, and 19.3.1.

If applications are using any of the above packages please upgrade to any of the fixed versions immediately.

If an app’s React code does not use a server, the app is not affected by this vulnerability. If an app does not use a framework, bundler, or bundler plugin that supports React Server Components, the app is not affected by this vulnerability.

Affected Software

12 affected componentsFixes available

npm/react-server-dom-webpack>=19.3.0<19.3.1

19.3.1

npm/react-server-dom-webpack>=19.2.0<19.2.9

19.2.9

npm/react-server-dom-webpack>=19.1.0<19.1.10

19.1.10

npm/react-server-dom-webpack>=19.0.0<19.0.9

19.0.9

npm/react-server-dom-turbopack>=19.3.0<19.3.1

19.3.1

npm/react-server-dom-turbopack>=19.2.0<19.2.9

19.2.9

npm/react-server-dom-turbopack>=19.1.0<19.1.10

19.1.10

npm/react-server-dom-turbopack>=19.0.0<19.0.9

19.0.9

npm/react-server-dom-parcel>=19.3.0<19.3.1

19.3.1

npm/react-server-dom-parcel>=19.2.0<19.2.9

19.2.9

npm/react-server-dom-parcel>=19.1.0<19.1.10

19.1.10

npm/react-server-dom-parcel>=19.0.0<19.0.9

19.0.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/react-server-dom-webpack to a version that resolves this vulnerability.
Fixed in 19.3.1
Upgrade
Upgrade npm/react-server-dom-webpack to a version that resolves this vulnerability.
Fixed in 19.2.9
Upgrade
Upgrade npm/react-server-dom-webpack to a version that resolves this vulnerability.
Fixed in 19.1.10
Upgrade
Upgrade npm/react-server-dom-webpack to a version that resolves this vulnerability.
Fixed in 19.0.9
Upgrade
Upgrade npm/react-server-dom-turbopack to a version that resolves this vulnerability.
Fixed in 19.3.1
Upgrade
Upgrade npm/react-server-dom-turbopack to a version that resolves this vulnerability.
Fixed in 19.2.9
Upgrade
Upgrade npm/react-server-dom-turbopack to a version that resolves this vulnerability.
Fixed in 19.1.10
Upgrade
Upgrade npm/react-server-dom-turbopack to a version that resolves this vulnerability.
Fixed in 19.0.9
Upgrade
Upgrade npm/react-server-dom-parcel to a version that resolves this vulnerability.
Fixed in 19.3.1
Upgrade
Upgrade npm/react-server-dom-parcel to a version that resolves this vulnerability.
Fixed in 19.2.9
Upgrade
Upgrade npm/react-server-dom-parcel to a version that resolves this vulnerability.
Fixed in 19.1.10
Upgrade
Upgrade npm/react-server-dom-parcel to a version that resolves this vulnerability.
Fixed in 19.0.9
Upgrade
Upgrade react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack to a version that resolves this vulnerability.
Fixed in 19.3.1

Event History

Nov 10, 2026

Advisory Published

via GitHub·10:44 PM

Data Sourced

via GitHub·10:44 PM

DescriptionWeaknessAffected Software

Data Sourced

via OSV·10:44 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which applications are actually affected?

Affected applications use react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack in the listed vulnerable versions and use a framework, bundler, or bundler plugin that supports React Server Components. Applications whose React code does not use a server, or that do not use React Server Components support, are not affected.

What conditions are needed for exploitation?

An attacker must be able to send a crafted payload to a vulnerable React Server Components implementation. The affected response must transport multiple typed arrays and include an attacker-controlled value; the advisory describes these cases as extremely rare.

Which versions should be used to remediate the issue?

Upgrade the affected package to 19.0.09, 19.1.10, 19.2.9, or 19.3.1. The vulnerable releases are 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0.

GHSA-xqc2-xf4c-x3h3: React: Unauthenticated Remote Code Execution in React Server Components

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are actually affected?

What conditions are needed for exploitation?

Which versions should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which applications are actually affected?

What conditions are needed for exploitation?

Which versions should be used to remediate the issue?