A critical security flaw identified as GHSA-xqc2-xf4c-x3h3 has been discovered in React Server Components, allowing unauthenticated remote code execution. The flaw has been assigned a CVSS v4 score of 9.5, indicating its severity.

The affected packages include react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. Vulnerable versions are 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0.

React has released fixed versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1 to address this vulnerability. The flaw allows crafted payloads targeting frameworks that support React Server Components to trigger remote code execution.

Exploitation of this vulnerability requires an extremely rare response pattern involving multiple typed arrays and a value controlled by an attacker. As of November 8, 2026, there are no public reports of exploitation in the wild.

React published the advisory for this flaw on October 14, 2026. Notably, the advisory does not carry a CVE identifier.