React Server Components flaw enables unauthenticated RCE

React advisory GHSA-xqc2-xf4c-x3h3 rates CVSS 9.5; attackers can execute code remotely without authentication in react-server-dom packages.

React published an advisory for a critical flaw in React Server Components tracked as GHSA-xqc2-xf4c-x3h3. The issue affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. It allows remote code execution without authentication through a rare response pattern involving multiple typed arrays and attacker-controlled data. The flaw carries a CVSS v4 score of 9.5 and impacts data privacy, integrity, and availability. Affected versions include 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0 across the packages. Fixed versions are 19.0.9, 19.1.10, 19.2.9, and 19.3.1. The advisory states no user interaction or account privileges are needed, but the required pattern is rare and not widely confirmed in production.

Unconfirmed: Public description does not establish how widely the required application pattern appears in production; no claim of active exploitation