React has patched a critical flaw in React Server Components that can allow remote code execution on servers without authentication. The official security advisory, tracked as GHSA-xqc2-xf4c-x3h3, was published on October 14, 2026, and scored 9.5 out of 10 on the CVSS v4 scale. The issue resurfaced among developers on Monday, November 9, with fresh warnings about the risk for applications that have not yet applied the fix.
What the flaw is
According to React's advisory, specially crafted payloads sent to frameworks that support React Server Components can trigger remote code execution. The attack condition is specific: the flaw appears when a server response carries multiple typed arrays alongside an attacker-controlled value.
The risk needs to be sized precisely: exploitation requires a response pattern the maintainers themselves describe as extremely rare. Not every React application is affected — apps that do not run React code on the server are out of scope, as are those without a framework, bundler or plugin supporting React Server Components. So far, there are no public reports of active exploitation and no public proof of concept for this specific flaw.
Affected versions and fixes
The flaw affects three packages — react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack — in versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0. The fixed versions are 19.0.9, 19.1.10, 19.2.9 and 19.3.1, and React recommends updating immediately.
The same release also fixed a separate denial-of-service issue in Server Functions, tracked as GHSA-h3gv-c5rc-p453.
Attention, Next.js users
Next.js published its own advisory for the same flaw, tracked as GHSA-673q-mjm6-r5xr, and shipped the fix less than an hour after React. Affected versions are 16.0.0 through 16.4.0 (apps using the App Router with Cache Components), and the fix is in version 16.4.1.
The detail that confuses developers most: Next.js ships its own copy of the RSC packages. That is why updating react and react-dom alone does not fix Next.js — the next package itself must be updated.
This is not React2Shell
The new flaw should not be confused with React2Shell (CVE-2025-55182), an earlier and distinct vulnerability, also in React Server Components, which scored the maximum CVSS 10.0 and was exploited at scale in December 2025. According to Upwind's analysis, which flagged the advisory on X, the new issue is a framing problem in React's wire protocol, not a deserialization gadget chain like React2Shell. The proof of concept that circulated in late October belongs to a different flaw, the Node.js Brotli bug known as Node2Shell.
Another detail: neither React's advisory nor Next.js's advisory received a CVE identifier — only GHSA codes.
What to do
If your application uses React Server Components, check the versions of react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack and update to the fixed versions. In Next.js projects, update next to 16.4.1 or later. Even if your app has no functions returning multiple typed arrays, the official recommendation is to update — according to Vercel, there is no workaround.
Sources
- Cyber Security News — Critical React Server Components Flaw Lets Hackers Execute Code Remotely Without Authentication
- GBHackers — Critical React Server Components Vulnerability Allows Unauthenticated Attackers to Execute Malicious Code on Servers
- TechloMedia — React's Critical RCE Flaw Also Exposes a Security Risk in Next.js
- Upwind — GHSA-xqc2-xf4c-x3h3: What the React Server Components Typed-Array RCE Means for Your Next.js Apps
Image credit: React logo, via Wikimedia Commons.
Transparency: this article was produced with the assistance of artificial intelligence, cross-checked against public posts on X and internet sources. Please consult the original sources to confirm the information.
By Muse
