Critical React Server Components Flaw Lets Hackers Execute Code Remotely Without Authentication

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com


A critical security flaw in React Server Components can let attackers run code remotely without logging in. React published the advisory, tracked as GHSA-xqc2-xf4c-x3h3, on October 14, 2026. The issue carries a CVSS v4 score of 9.5, and the React team recommends immediate updates for affected applications.

The flaw affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. These packages support React Server Components across different build tools.

However, the advisory makes an important distinction: exploitation requires an extremely rare response pattern involving multiple typed arrays and a value controlled by an attacker. Simply using React does not make every application vulnerable.

React Server Components Vulnerability

According to React, specially crafted payloads targeting frameworks that support React Server Components can trigger remote code execution. Typed arrays hold numeric data in defined formats.

The advisory identifies responses carrying several of these arrays alongside attacker-controlled data as the relevant condition, but does not publish a complete technical breakdown or exploit instructions.

The severity rating reflects the potential impact despite that narrow requirement. An attacker needs no account privileges, and exploitation requires no user interaction. The advisory rates the possible effects on data privacy, data integrity, and service availability as high. However, its public description does not establish how widely the required application pattern appears in production.

The disclosure follows earlier React security issues covered in Cyber Security News’s reporting on React2Shell exploitation. Readers should not confuse those attacks with this advisory.

React2Shell was tracked as CVE-2025-55182, while the October advisory lists no known CVE identifier. Evidence of attacks against the older flaw does not establish exploitation of this newer issue.

Affected Versions and Available Fixes

The official React security advisory lists affected releases as 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0 across all three packages. Fixed releases are 19.0.9, 19.1.10, 19.2.9, and 19.3.1. The advisory’s package tables confirm 19.0.9, despite a typo showing “19.0.09” in its patch description.

Package Affected versions Patched versions
react-server-dom-parcel 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0 19.0.9, 19.1.10, 19.2.9, 19.3.1
react-server-dom-turbopack 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0 19.0.9, 19.1.10, 19.2.9, 19.3.1
react-server-dom-webpack 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0 19.0.9, 19.1.10, 19.2.9, 19.3.1

Cyber Security News also covered related Next.js vulnerabilities, including a Cache Components issue involving multiple typed arrays. For this React flaw, teams should check the installed server-dom package versions against the official affected ranges rather than rely on older patch guidance.

React explicitly recommends upgrading affected packages immediately. Applications without server-side React code are not affected, nor are applications without a framework, bundler, or plugin supporting React Server Components.

The public notice also provides no claim of active exploitation. Those distinctions matter when assessing exposure and reporting the vulnerability accurately.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Critical React Server Components Flaw Lets Hackers Execute Code Remotely Without Authentication appeared first on Cyber Security News.