Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitycritical

React Server Components Flaw Enables Unauthenticated Code Execution

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

React advisory GHSA-xqc2-xf4c-x3h3 rates CVSS 9.5; attackers can execute code remotely without authentication in react-server-dom packages.

React published advisory GHSA-xqc2-xf4c-x3h3 for a critical flaw in react-server-dom packages. The issue allows remote code execution without authentication through a rare response pattern involving multiple typed arrays and attacker-controlled data. Affected packages are react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0.0 through 19.3.0. Fixed versions are 19.0.9, 19.1.10, 19.2.9, and 19.3.1. The CVSS v4 score is 9.5 with no user interaction or account privileges required.

Key facts
  • Affected packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack
  • Vulnerable versions: 19.0.0-19.3.0
  • Fixed versions: 19.0.9, 19.1.10, 19.2.9, 19.3.1
  • CVSS v4 score: 9.5
  • No user interaction or authentication required
  • Rare response pattern with typed arrays
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 14, 2026React advisory GHSA-xqc2-xf4c-x3h3 released · GBHackers

What each outlet adds

beyond the shared facts
  • Cyber Security NewsFlaw details on typed arrays and response pattern
  • GBHackersAdvisory release date October 14, 2026
Vendors
ReactMeta
Products
react-server-dom-webpackreact-server-dom-parcelreact-server-dom-turbopack

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Cyber Security NewsFirst report

    React Server Components flaw enables unauthenticated RCE

    React advisory GHSA-xqc2-xf4c-x3h3 rates CVSS 9.5; attackers can execute code remotely without authentication in react-server-dom packages.

  2. · 1d ago GBHackers

    React Server Components vulnerability allows unauthenticated RCE

    React Server Components vulnerability GHSA-xqc2-xf4c-x3h3 affects packages react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack versions 19.0.0-19.3.0.