# React: Unauthenticated Remote Code Execution in React Server Components (CVE-2026-126187)

Source: [GitHub Advisory Database](https://github.com/advisories/GHSA-xqc2-xf4c-x3h3) · 2026-11-10 · Security
Page: https://themorning.dev/story/react-unauthenticated-remote-code-execution-in-react-server-components-cve-2026-34bd1292a333e0c1
Kind: security · Impact: high

## In brief

- GitHub Advisory Database published CVE-2026-126187, an unauthenticated remote code execution flaw in React Server Components.
- Crafted payloads targeting frameworks that support React Server Components can lead to remote code execution.
- Affected packages are react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack; the advisory says it only affects extremely rare cases where responses transport multiple payloads.

## Why it matters

Developers running frameworks that use React Server Components with these bundler packages may be exposed to unauthenticated code execution, so they should check whether their applications depend on the affected packages.

## CVEs

- CVE-2026-126187

## Timeline

- 2026-11-10: Vulnerability disclosed in GitHub Advisory Database (GHSA-xqc2-xf4c-x3h3)

## Coverage

- [React: Unauthenticated Remote Code Execution in React Server Components (CVE-2026-126187)](https://github.com/advisories/GHSA-xqc2-xf4c-x3h3) — GitHub Advisory Database, 2026-11-10

Tags: react, security, rce, react-server-components, cve, vulnerability

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev