CVE-2026-126187
CriticalCVSS 9.5Summary
The react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages from 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1 are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value; applications without server-side React code or without a framework/bundler supporting React Server Components are not affected.
Risk Assessment
Applications using React Server Components may allow an unauthenticated attacker to achieve remote code execution, potentially leading to compromise of the application server.
Recommendation
Update the listed packages to versions 19.0.9, 19.1.10, 19.2.9, or 19.3.1 and verify whether the application actually uses React Server Components.
Other vulnerabilities in React Server Components
See all- CVE-2025-67779High
Vulnerability in React Server Components versions 19.0.2, 19.1.3 and 19.2.2 is an incomplete fix for CVE-2025-55184 and still allows unsafe deserialization of payloads from HTTP requests to Server Function endpoints, causing an infinite loop that hangs the server process.
- CVE-2025-55184High
Pre-authentication denial of service vulnerability in React Server Components versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack, allows unsafe deserialization of payloads from HTTP requests to Server Function endpoints, causing an infinite loop that hangs the server process.
- CVE-2025-55183Medium
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function.
- CVE-2025-55182CriticalActively exploited
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
- CVE-2026-23869High
A denial of service vulnerability in React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) versions 19.0.0-19.0.4, 19.1.0-19.1.5, and 19.2.0-19.2.4. Specially crafted HTTP requests to Server Function endpoints cause excessive CPU usage for about a minute, ending in a catchable error.
- CVE-2026-23864High
Multiple denial of service vulnerabilities have been found in React Server Components packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack). Specially crafted HTTP requests to Server Function endpoints can cause server crashes, out-of-memory exceptions, or excessive CPU usage.
Original NVD description (English source)
React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS