Security · High impactFan score 65 · Tier A
React: Unauthenticated Remote Code Execution in React Server Components (CVE-2026-126187)
The Brief
- GitHub Advisory Database published CVE-2026-126187, an unauthenticated remote code execution flaw in React Server Components.
- Crafted payloads targeting frameworks that support React Server Components can lead to remote code execution.
- Affected packages are react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack; the advisory says it only affects extremely rare cases where responses transport multiple payloads.
Why it matters
Developers running frameworks that use React Server Components with these bundler packages may be exposed to unauthenticated code execution, so they should check whether their applications depend on the affected packages.
Who’s affected
- Teams using react-server-dom-parcel
- Teams using react-server-dom-turbopack
- Teams using react-server-dom-webpack
- CVE-2026-126187
- #react
- #security
- #rce
- #react-server-components
- #cve
- #vulnerability
Affects react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. Impact Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely rare cases where responses transport multiple…
Timeline
Vulnerability disclosed in GitHub Advisory Database (GHSA-xqc2-xf4c-x3h3)
GitHub Advisory Database
React: Unauthenticated Remote Code Execution in React Server Components (CVE-2026-126187)