International
The Morning Dev

Only the news worth knowing

‹
 
A65/100

Vulnerability · critical · CVSS 9.5

React Server Components unauthenticated remote code execution (CVE-2026-126187)

Tier A · Patch today – Before you go home

Who’s exposed: Apps using React Server Components through the affected react-server-dom bundler packages

Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover

Reach

Attack

Damage

Fix

Popular tool · Remote, no login · Full takeover

The Brief

  • GitHub Advisory Database published CVE-2026-126187, an unauthenticated remote code execution flaw in React Server Components.
  • Crafted payloads targeting frameworks that support React Server Components can lead to remote code execution.
  • Affected packages are react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack; the advisory says it only affects extremely rare cases where responses transport multiple payloads.

Why it matters

Developers running frameworks that use React Server Components with these bundler packages may be exposed to unauthenticated code execution, so they should check whether their applications depend on the affected packages.

The checklist behind the tier

Checklist · 4 of 10 yes
YesHits tech teamsReact Server Components are framework tooling developers build and run apps with, so yes.
NoCore infrastructureA single UI framework's server components, not core infrastructure like OpenSSH or the Linux kernel.
YesPopular toolReact is a widely used mainstream framework, and its server components are used by many teams.
NoExploited in the wildGitHub Advisory Database (2026-11-10) describes the flaw but reports no observed attacks or KEV listing.
NoPublic exploitGitHub Advisory Database (2026-11-10) gives an impact summary only; no exploit code or PoC is mentioned.
YesRemote, no loginCVSSCVE-2026-126187: CVSS 9.5 – network, no privileges, no user interaction
YesFull takeoverCVSSCVE-2026-126187: CVSS rates confidentiality and integrity impact high
NoSecrets exposedGitHub Advisory Database (2026-11-10) reports RCE only; no credential or data theft is mentioned.
NoSupply chainGitHub Advisory Database (2026-11-10) describes a vulnerability, not a compromised package or malicious release.
NoNo fix yetGitHub AdvisoryGitHub Advisory: react-server-dom-parcel fixed in 19.0.9 (+2 more packages)

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

  • CVE-2026-126187 ↗CVSS 9.5 critical AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

    React: Unauthenticated Remote Code Execution in React Server Components

    Exploited
    Not in CISA’s exploited catalog
    Fix
    • react-server-dom-parcel (npm) fixed in 19.0.9
    • react-server-dom-parcel (npm) fixed in 19.1.10
    • react-server-dom-parcel (npm) fixed in 19.2.9
    • react-server-dom-parcel (npm) fixed in 19.3.1
    • react-server-dom-turbopack (npm) fixed in 19.0.9
    • react-server-dom-turbopack (npm) fixed in 19.1.10
    Weakness
    CWE-502

    NVDGHSA-xqc2-xf4c-x3h3

Timeline

  1. Vulnerability disclosed in GitHub Advisory Database (GHSA-xqc2-xf4c-x3h3)

  2. GitHub Advisory Database

    React: Unauthenticated Remote Code Execution in React Server Components (CVE-2026-126187)

Source

React: Unauthenticated Remote Code Execution in React Server Components (CVE-2026-126187) ↗ GitHub Advisory Database · 1h ago

First seen · 1 source · Full story page · How tiers are decided