React Server Components vulnerability allows unauthenticated RCE

React Server Components vulnerability GHSA-xqc2-xf4c-x3h3 affects packages react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack versions 19.0.0-19.3.0.

A serious vulnerability in React Server Components may enable unauthenticated attackers to execute malicious code on affected servers. The advisory, released on October 14, 2026, assigns the issue a CVSS v4.0 score of 9.5. The vulnerable condition involves responses that transport multiple typed arrays along with an attacker-controlled value. The advisory does not disclose a detailed exploitation sequence or identify the underlying coding error. The vulnerability affects three npm packages: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. Vulnerable releases span versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0. Fixed versions are 19.0.9, 19.1.10, 19.2.9, and 19.3.1 across all three affected packages.

Unconfirmed: The advisory does not establish that attackers have achieved those outcomes in production environments