A newly disclosed security vulnerability in React Server Components could allow attackers to run arbitrary code on servers without needing to log in. React issued a security advisory—tagged GHSA-xqc2-xf4c-x3h3—on October 14, 2026, which assigns the flaw a severity of 9.5 on the CVSS v4 scale. All users of the affected packages are urged to patch immediately.
What’s at Risk and What’s Affected
The flaw lies within three core React Server Components packages: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. These libraries enable React Server Components across various build tools. Only applications using these specific server-DOM integrations are potentially vulnerable. A key detail: exploitation depends on a rare combination of response types involving multiple typed arrays together with data supplied by an attacker. Standard use of React doesn’t automatically open the door to this exposure.
How It Works and Why It’s Dangerous
Attackers crafting special payloads against frameworks leveraging React Server Components can trigger remote code execution without authentication or any user interaction. The advisory highlights that the vulnerability impacts data integrity, data privacy, and availability—meaning compromised servers could leak private data or malfunction entirely. Though the advisory doesn’t clarify how common the vulnerable response patterns are in real-world applications, the risk is elevated by the fact that no privileges are required to exploit the issue externally.
Version Details & How to Fix It
The affected releases include versions 19.0.0 through 19.0.8; 19.1.0 through 19.1.9; 19.2.0 through 19.2.8; plus 19.3.0—across all three of the server-DOM packages. Fixed versions are 19.0.9, 19.1.10, 19.2.9, and 19.3.1. Users should note a typo in the advisory: it lists 19.0.09 instead of 19.0.9 in one spot. If your application includes server-side React code and relies on one of these specific packages, check your version and update to a patched release immediately. If it doesn’t use server-side rendering or these specific build integrations, your exposure is minimal.
Current Exposure & Previous Issues
There’s no evidence yet that this flaw is being actively exploited in the wild. It builds on earlier React concerns, but is distinct from past incidents—such as the React2Shell vulnerability—which had different tracking identifiers and attack vectors. That said, developers should avoid confusing affected patterns or importing mitigation strategies from unrelated vulnerabilities. This is a new threat with its own technical quirks.
What this means: this vulnerability underscores how even minor-looking components like typed arrays can introduce severe risks when combined with server-side rendering features. For teams maintaining apps with React Server Components, the clock is ticking—patches exist now, but the fragile barrier between “safe” and “vulnerable” can be thin. Watch for your build tools’ integrations, audit any server-DOM usage, and ensure automated updates or alerts are in place.
