A significant security vulnerability within React Server Components has been identified, allowing attackers to execute code remotely without requiring authentication. This flaw was disclosed by React in an advisory dated October 14, 2026, and is cataloged as GHSA-xqc2-xf4c-x3h3. The vulnerability has been assessed with a CVSS v4 score of 9.5, underscoring its critical nature. React’s development team advises immediate updates for applications utilizing the affected components.
Affected Components and Exploitation Details
This vulnerability impacts specific packages: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. These packages are integral to supporting React Server Components across various build tools. Not all applications that use React are at risk, as the flaw necessitates a specific, rare pattern in response handling.
Exploitation of this flaw involves crafted payloads targeting frameworks that incorporate React Server Components. These payloads utilize multiple typed arrays, which are data structures containing numeric data in defined formats, along with data controlled by the attacker. The advisory highlights that no user interaction or account privileges are needed for exploitation, increasing the potential risk to data confidentiality, integrity, and availability.
Comparing Past and Present Security Concerns
Previous security issues with React, such as the React2Shell vulnerability (CVE-2025-55182), have been documented by Cyber Security News. However, this current advisory does not attribute a CVE identifier and should not be confused with earlier exploits. Evidence of attacks on the older flaw does not imply exploitation of this new issue.
The advisory specifies the affected versions as 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0 across all three packages. Updated versions include 19.0.9, 19.1.10, 19.2.9, and 19.3.1. A noted typo in the patch documentation should be carefully checked to avoid confusion.
Recommendations and Precautionary Measures
React’s advisory strongly recommends updating to the patched package versions to mitigate this vulnerability. Applications that do not utilize server-side React code or lack frameworks supporting React Server Components are not affected. It’s imperative to verify package versions against the official list rather than relying on previous patch notes.
Currently, no evidence of active exploitation has been reported, but organizations should remain vigilant. Ensuring accurate assessment and reporting of this vulnerability will aid in proper risk management and protection against potential threats.
