# CVE-2026-126187: React Server Components Flaw Lets Attackers Execute Code Through Smuggled Flight Rows

Source: [Step Security Blog](https://www.stepsecurity.io/blog/cve-2026-126187-react-flight-rce) · 2026-11-12 · Security
Page: https://themorning.dev/story/cve-2026-126187-react-server-components-flaw-lets-attackers-execute-code-through-471550b68478cedc
Kind: security · Impact: high

## In brief

- GitHub Advisory Database published CVE-2026-126187, an unauthenticated remote code execution flaw in React Server Components.
- Crafted payloads targeting frameworks that support React Server Components can lead to remote code execution.
- Affected packages are react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack; the advisory says it only affects extremely rare cases where responses transport multiple payloads.

## Why it matters

Developers running frameworks that use React Server Components with these bundler packages may be exposed to unauthenticated code execution, so they should check whether their applications depend on the affected packages.

## CVEs

- CVE-2026-126187

## Timeline

- 2026-11-10: Vulnerability disclosed in GitHub Advisory Database (GHSA-xqc2-xf4c-x3h3)

## Coverage

- [CVE-2026-126187: React Server Components Flaw Lets Attackers Execute Code Through Smuggled Flight Rows](https://www.stepsecurity.io/blog/cve-2026-126187-react-flight-rce) — Step Security Blog, 2026-11-12
- [React: Unauthenticated Remote Code Execution in React Server Components (CVE-2026-126187)](https://github.com/advisories/GHSA-xqc2-xf4c-x3h3) — GitHub Advisory Database, 2026-11-10

Tags: react, security, rce, react-server-components, cve, vulnerability

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev