Is CVE-2026-126187 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126187 being exploited in the wild.

How severe is CVE-2026-126187?

Critical severity, with a CVSS score of 4, published 10 November 2026.

Which products and versions are affected?

Meta React-Server-Dom-Parcel 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0; Meta React-Server-Dom-Turbopack 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0; Meta React-Server-Dom-Webpack 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0; react-server-dom-parcel (npm) >= 19.0.0, < 19.0.9, SEMVER:introduced=19.0.0,fixed=19.0.9; and 2 more.

How is CVE-2026-126187 attacked?

It is attacked over the network.

Am I affected by CVE-2026-126187?

Check whether you run Meta React-Server-Dom-Parcel, Meta React-Server-Dom-Turbopack, Meta React-Server-Dom-Webpack or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126187: React Server Components remote code execution via deserialization

Q: Is there a fix for CVE-2026-126187?

Yes. react-server-dom-parcel (npm): upgrade to 19.0.9 or later; react-server-dom-turbopack (npm): upgrade to 19.0.9 or later; react-server-dom-webpack (npm): upgrade to 19.0.9 or later. Until then: Applications that do not use a server or do not use a framework, bundler, or bundler plugin supporting React Server Components are not affected and do not require upgrading. [ { "kind": "disclosed", "at": "2026-10-14" }, { "kind": "advisory", "at": "2026-11-10" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-126187 · Severity: critical · CVSS 4 · Published 2026-11-10

React Server Components, used in frameworks like Next.js to generate dynamic content on the server, contain a deserialization flaw that allows unauthenticated attackers to execute arbitrary code. An attacker can craft malicious payloads that exploit how the components process typed arrays in responses, gaining full control of the server if the application uses affected React packages. This affects only applications using server-side React rendering with the vulnerable packages.

Technologies: react-server-dom-parcel (npm), react-server-dom-turbopack (npm), react-server-dom-webpack (npm). Vendors: Meta, npm.

Quick answers

Is CVE-2026-126187 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126187 being exploited in the wild.
How severe is CVE-2026-126187?: Critical severity, with a CVSS score of 4, published 10 November 2026.
Which products and versions are affected?: Meta React-Server-Dom-Parcel 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0; Meta React-Server-Dom-Turbopack 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0; Meta React-Server-Dom-Webpack 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0; react-server-dom-parcel (npm) >= 19.0.0, < 19.0.9, SEMVER:introduced=19.0.0,fixed=19.0.9; and 2 more.
Is there a fix for CVE-2026-126187?: Yes. react-server-dom-parcel (npm): upgrade to 19.0.9 or later; react-server-dom-turbopack (npm): upgrade to 19.0.9 or later; react-server-dom-webpack (npm): upgrade to 19.0.9 or later. Until then: Applications that do not use a server or do not use a framework, bundler, or bundler plugin supporting React Server Components are not affected and do not require upgrading.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-14" }, { "kind": "advisory", "at": "2026-11-10" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126187 attacked?: It is attacked over the network.
Am I affected by CVE-2026-126187?: Check whether you run Meta React-Server-Dom-Parcel, Meta React-Server-Dom-Turbopack, Meta React-Server-Dom-Webpack or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

react-server-dom-parcel (npm): upgrade to 19.0.9 or later
```
npm install react-server-dom-parcel@19.0.9
```
react-server-dom-turbopack (npm): upgrade to 19.0.9 or later
```
npm install react-server-dom-turbopack@19.0.9
```
react-server-dom-webpack (npm): upgrade to 19.0.9 or later
```
npm install react-server-dom-webpack@19.0.9
```

Applications that do not use a server or do not use a framework, bundler, or bundler plugin supporting React Server Components are not affected and do not require upgrading.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-14" }, { "kind": "advisory", "at": "2026-11-10" } ]

Technical details

A deserialization vulnerability (CWE-502) in react-server-dom packages allows remote code execution when responses contain multiple typed arrays and attacker-controlled values. The flaw is triggered via network-based payload crafting with no authentication or user interaction required, but only manifests in the rare case where the specific preconditions are met. An attacker gains full code execution in the server context where the vulnerable package processes the malicious serialized data.

Affected products

Meta react-server-dom-webpack 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0
Meta react-server-dom-parcel 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0
Meta react-server-dom-turbopack 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0

Identifiers

CVE-2026-126187
GHSA-xqc2-xf4c-x3h3

References

https://api.github.com/users/evolutionstorm

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.