Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-11122 | Publication Date: 12 November 2026

Unauthenticated Remote Code Execution in React Server Components
CVE-2026-126187

Summary

A critical deserialization vulnerability has been identified in the React Server Components (RSC) transport packages. Tracked as CVE-2026-126187, the flaw allows an unauthenticated remote attacker to achieve remote code execution on servers that use React Server Components with certain bundler integrations.

The vulnerability has been assigned a CVSS v4.0 score of 9.5 (Critical). It affects the packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack in specific 19.x release lines. Fixed versions were released on 14 October 2026; the CVE identifier was assigned on 10 November 2026. Public proof-of-concept material is available.

Technical Overview

The issue is a deserialization of untrusted data weakness (CWE-502) in the React Server Components payload handling path. When a server response transports multiple typed arrays together with an attacker-controlled value, a crafted payload can lead to arbitrary code execution in the context of the Node.js server process.

According to the React project, the vulnerable condition is limited to extremely rare cases. Applications that do not use React Server Components, or that do not use a framework/bundler/plugin that supports RSC (such as webpack, Parcel, or Turbopack), are not affected. Pure client-side React applications are not affected.

Next.js applications that ship or depend on the affected packages (notably Next.js 16.0.0 through 16.4.0) are also in scope and should be upgraded to the corresponding fixed release.

Affected Systems

• react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack:
  • 19.0.0 through 19.0.8
  • 19.1.0 through 19.1.9
  • 19.2.0 through 19.2.8
  • 19.3.0
• Next.js 16.0.0 through 16.4.0 (when using the affected RSC packages)

Fixed versions:

• React RSC packages: 19.0.9, 19.1.10, 19.2.9, 19.3.1
• Next.js: 16.4.1 or later

Exploitation Status

• Security advisory and fixed packages published by the React project on 14 October 2026.
• CVE identifier assigned on 10 November 2026.
• Public proof-of-concept material is available.
• No widespread in-the-wild exploitation confirmed as of this advisory’s publication.
• Not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Recommendations

1. Immediate Action: Upgrade the affected React Server Components packages to the fixed versions listed above (19.0.9, 19.1.10, 19.2.9, or 19.3.1 depending on your release line).
2. If you use Next.js 16.x, upgrade to 16.4.1 or later and verify that the underlying react-server-dom-* packages are also at a patched version.
3. Audit package.json / lockfiles for any direct or transitive dependency on the vulnerable packages and force resolution to a fixed version where necessary.
4. Redeploy applications after the dependency update so that the patched packages are loaded in production.
5. Review application logs and monitoring for anomalous server-side behavior or unexpected process activity around and after the disclosure window.
6. There is no reliable configuration-only workaround documented by the vendor; patching is the required remediation.
7. If compromise is suspected, treat the environment as compromised: isolate affected hosts, preserve forensic evidence, rotate secrets and credentials accessible to the Node.js process, and perform a full integrity review.

Although the React project describes the exploitable condition as rare, the combination of unauthenticated remote code execution, public proof-of-concept availability, and the widespread use of React and Next.js justifies treating this as a high-priority update for any organization running React Server Components in production.

Karen IT
We make the Internet harder to abuse.