# React Server Components: code execution under specific response conditions Canonical: https://www.oktsec.com/radar/react-server-components-cve-2026-126187 Publisher: Oktsec Language: en Published: 2026-11-11T19:05:04Z Updated: 2026-11-11T19:05:04Z Record reviewed: 2026-11-11T19:05:04Z Latest evidence check: 2026-11-11T19:05:04Z Disclosed: 2026-10-14 React warns that crafted payloads can execute code in frameworks supporting Server Components when responses transport multiple typed arrays and a value controlled by an attacker. The advisory does not report exploitation in the wild. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: The maintainer recommends immediate updates, but exploitation requires specific RSC response contents described as extremely rare. No attacks are reported in the reviewed advisory; prioritize confirmed applicable deployments. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: React - Products: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack - CVEs: CVE-2026-126187 - Vendor severity: CVSS 4.0 9.5 ## Technical overview The maintainer published this advisory on October 14. Crafted payloads can cause remote code execution in frameworks supporting React Server Components, but the described path depends on responses carrying multiple typed arrays and a value controlled by an attacker. React characterizes these conditions as extremely rare. The three affected packages are react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack. Their corrected branch versions are 19.0.9, 19.1.10, 19.2.9 and 19.3.1. Applications whose React code runs only in the browser are not affected, nor are applications without a framework, bundler or plugin supporting Server Components. The reviewed advisory does not establish attacks in the wild. Oktsec recommends checking actual server dependencies and response behavior, applying the corrected packages and verifying the deployed build. A critical severity score does not establish exploitation or make every React application vulnerable. ## Recommended response Check deployed react-server-dom packages and update the affected branch to 19.0.9, 19.1.10, 19.2.9 or 19.3.1. Rebuild and redeploy the server; prioritize applications matching the response conditions. Relevant to: Teams operating frameworks, bundlers or plugins that support React Server Components. ## CVE attribution - CVE-2026-126187: React — react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack. [Source](https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3) ## Affected systems and fixes ### react-server-dom-webpack Affected: 19.0.0–19.0.8; 19.1.0–19.1.9; 19.2.0–19.2.8; 19.3.0 Fixed release / action: 19.0.9; 19.1.10; 19.2.9; 19.3.1 ### react-server-dom-parcel Affected: 19.0.0–19.0.8; 19.1.0–19.1.9; 19.2.0–19.2.8; 19.3.0 Fixed release / action: 19.0.9; 19.1.10; 19.2.9; 19.3.1 ### react-server-dom-turbopack Affected: 19.0.0–19.0.8; 19.1.0–19.1.9; 19.2.0–19.2.8; 19.3.0 Fixed release / action: 19.0.9; 19.1.10; 19.2.9; 19.3.1 Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-11T19:05:18.382Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-11T19:05:18.382Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-126187 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-11T19:05:18.382Z. ### Official regional advisories - [Vulnerabilidad en React Server Components](https://www.cert.gov.py/vulnerabilidad-en-react-server-components/) — CERT-PY, Paraguay; publication 2026-11-11T12:17:30.000Z; observed 2026-11-11T19:05:18.382Z; matched by exact CVE identifier. Publisher country does not establish victim location. Original notices may repeat the same underlying advisory. ## Response checklist 1. **Confirm Server Components are in use** — Inspect deployed server dependencies and framework support for React Server Components. Apps whose React code runs only in the browser, or that lack a framework, bundler or plugin supporting RSC, are outside the maintainer’s stated scope. 2. **Review the response conditions** — The advisory requires responses transporting multiple typed arrays together with a value controlled by an attacker. Oktsec recommends tracing these responses and prioritizing applicable exposed servers; uncertainty is a reason to update, not proof of exploitation. 3. **Update and verify the deployed server** — Use 19.0.9, 19.1.10, 19.2.9 or 19.3.1 in the matching affected package branch, or a later corrected release. Follow framework compatibility guidance, rebuild, redeploy and verify installed versions in the running server. ## Relevance to AI environments Check web interfaces used by agent platforms only if their server uses the affected RSC packages; browser rendering alone does not establish exposure. ## Sources - [React Server Components: maintainer security advisory](https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3) — React; Vendor notice; checked 2026-11-11T19:05:04Z ## Editorial record - 2026-11-11T19:05:04Z: Added the October maintainer advisory with package versions, response conditions and explicit exclusions for unaffected applications. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/react-server-components-cve-2026-126187) · [Build a response plan](https://www.oktsec.com/radar/react-server-components-cve-2026-126187#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=react-server-components-cve-2026-126187&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=react-server-components-cve-2026-126187&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.