CVE-2026-126187 React: Unauthenticated Remote Code Execution in React Server Components
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-126187?
CVE-2026-126187 is a critical vulnerability in react, published on 10 Nov 2026.
Official description
React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.
Weakness: CWE-502
Which versions are affected by CVE-2026-126187?
12 open source packages ship an affected version, including react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack.
| Package | Affected | Fixed in |
|---|---|---|
react-server-dom-parcel npm | From 19.0.0 | 19.0.9 |
react-server-dom-parcel npm | From 19.1.0 | 19.1.10 |
react-server-dom-parcel npm | From 19.2.0 | 19.2.9 |
react-server-dom-parcel npm | From 19.3.0 | 19.3.1 |
react-server-dom-turbopack npm | From 19.0.0 | 19.0.9 |
react-server-dom-turbopack npm | From 19.1.0 | 19.1.10 |
6 more packages
react-server-dom-turbopack npm | From 19.2.0 | 19.2.9 |
react-server-dom-turbopack npm | From 19.3.0 | 19.3.1 |
react-server-dom-webpack npm | From 19.0.0 | 19.0.9 |
react-server-dom-webpack npm | From 19.1.0 | 19.1.10 |
react-server-dom-webpack npm | From 19.2.0 | 19.2.9 |
react-server-dom-webpack npm | From 19.3.0 | 19.3.1 |
How do I fix CVE-2026-126187?
Upgrade react-server-dom-parcel to a fixed version for your release line: 19.0.9, 19.1.10, 19.2.9 or 19.3.1.
Is CVE-2026-126187 being exploited?
There is no known exploitation of CVE-2026-126187 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Sources
Also known as GHSA-xqc2-xf4c-x3h3, UBUNTU-CVE-2026-126187.