Unauthenticated Remote Code Execution in React Server Components Framework
CVE-2026-126187
9.5CRITICAL
What is CVE-2026-126187?
A security vulnerability present in versions 19.0.0 to 19.0.9, 19.1.10, 19.2.9, and 19.3.1 of React's server component packages can allow unauthenticated remote code execution. This occurs specifically in scenarios where responses include multiple typed arrays alongside an attacker-controlled value. Applications that do not utilize a server, or those not employing frameworks, bundlers, or plugins supporting React Server Components, remain unaffected. This issue has been remedied in subsequent releases of the affected packages.
Affected Version(s)
react >= 19.0.0, < 19.0.9 < 19.0.0, 19.0.9
react >= 19.1.0, < 19.1.10 < 19.1.0, 19.1.10
react >= 19.2.0, < 19.2.9 < 19.2.0, 19.2.9