Security · High impactFan score 65 · Tier A2 sources

CVE-2026-126187: React Server Components Flaw Lets Attackers Execute Code Through Smuggled Flight Rows

The Brief · written from 2 sources

GitHub Advisory Database published CVE-2026-126187, an unauthenticated remote code execution flaw in React Server Components.
Crafted payloads targeting frameworks that support React Server Components can lead to remote code execution.
Affected packages are react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack; the advisory says it only affects extremely rare cases where responses transport multiple payloads.

Why it matters

Developers running frameworks that use React Server Components with these bundler packages may be exposed to unauthenticated code execution, so they should check whether their applications depend on the affected packages.

Who’s affected

Teams using react-server-dom-parcel
Teams using react-server-dom-turbopack
Teams using react-server-dom-webpack

CVE-2026-126187
#react
#security
#rce
#react-server-components
#cve
#vulnerability

React shipped fixes on November 10, 2026 for a CVSS 9.5 unauthenticated RCE in React Server Components' Flight protocol. Read how a silent serialization bug turns typed arrays into code execution, who is exposed, and how to find affected installs in CI and on developer machines.

Read the full story at stepsecurity.io ↗