# CVE-2026-126187: React Server Components remote code execution via deserialization

Source: https://junglewise.ai/threats/cve-2026-126187-react-unauthenticated-remote-code-execution-in-react-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-126187 · Severity: critical · CVSS 4 · Published 2026-11-10

React Server Components, used in frameworks like Next.js to generate dynamic content on the server, contain a deserialization flaw that allows unauthenticated attackers to execute arbitrary code. An attacker can craft malicious payloads that exploit how the components process typed arrays in responses, gaining full control of the server if the application uses affected React packages. This affects only applications using server-side React rendering with the vulnerable packages.

Technologies: [react-server-dom-parcel (npm)](https://junglewise.ai/threats/technologies/react-server-dom-parcel), [react-server-dom-turbopack (npm)](https://junglewise.ai/threats/technologies/react-server-dom-turbopack), [react-server-dom-webpack (npm)](https://junglewise.ai/threats/technologies/react-server-dom-webpack). Vendors: [Meta](https://junglewise.ai/threats/vendors/meta), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-126187 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126187 being exploited in the wild.

**How severe is CVE-2026-126187?** Critical severity, with a CVSS score of 4, published 10 November 2026.

**Which products and versions are affected?** Meta React-Server-Dom-Parcel 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0; Meta React-Server-Dom-Turbopack 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0; Meta React-Server-Dom-Webpack 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0; react-server-dom-parcel (npm) >= 19.0.0, < 19.0.9, SEMVER:introduced=19.0.0,fixed=19.0.9; and 2 more.

**Is there a fix for CVE-2026-126187?** Yes. react-server-dom-parcel (npm): upgrade to 19.0.9 or later; react-server-dom-turbopack (npm): upgrade to 19.0.9 or later; react-server-dom-webpack (npm): upgrade to 19.0.9 or later. Until then: Applications that do not use a server or do not use a framework, bundler, or bundler plugin supporting React Server Components are not affected and do not require upgrading.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-14"
  },
  {
    "kind": "advisory",
    "at": "2026-11-10"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126187 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-126187?** Check whether you run Meta React-Server-Dom-Parcel, Meta React-Server-Dom-Turbopack, Meta React-Server-Dom-Webpack or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- react-server-dom-parcel (npm): upgrade to 19.0.9 or later

  ```sh
  npm install react-server-dom-parcel@19.0.9
  ```

- react-server-dom-turbopack (npm): upgrade to 19.0.9 or later

  ```sh
  npm install react-server-dom-turbopack@19.0.9
  ```

- react-server-dom-webpack (npm): upgrade to 19.0.9 or later

  ```sh
  npm install react-server-dom-webpack@19.0.9
  ```


Applications that do not use a server or do not use a framework, bundler, or bundler plugin supporting React Server Components are not affected and do not require upgrading.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-14"
  },
  {
    "kind": "advisory",
    "at": "2026-11-10"
  }
]

## Technical details

A deserialization vulnerability (CWE-502) in react-server-dom packages allows remote code execution when responses contain multiple typed arrays and attacker-controlled values. The flaw is triggered via network-based payload crafting with no authentication or user interaction required, but only manifests in the rare case where the specific preconditions are met. An attacker gains full code execution in the server context where the vulnerable package processes the malicious serialized data.

## Affected products

- Meta react-server-dom-webpack 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0
- Meta react-server-dom-parcel 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0
- Meta react-server-dom-turbopack 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0

## Identifiers

- CVE-2026-126187
- GHSA-xqc2-xf4c-x3h3

## References

- [https://api.github.com/users/evolutionstorm](https://api.github.com/users/evolutionstorm)

## Related threats

- [Meta React denial of service in Server Functions](https://junglewise.ai/threats/cve-2026-44907-meta-react-denial-of-service-in-server-functions)
- [Facebook React Denial of Service in React Server Components](https://junglewise.ai/threats/cve-2026-23870-facebook-react-denial-of-service-in-react-server-components)
- [Meta React Server Components denial of service in Server Functions](https://junglewise.ai/threats/cve-2026-23869-meta-react-server-components-denial-of-service-in-server)
- [Meta React Server Components denial of service in Server Function endpoints](https://junglewise.ai/threats/cve-2026-23864-meta-react-server-components-denial-of-service-in-server-function)
- [It was found that the fix addressing in React Server Components was incomplete and does not prevent a denial of service attac](https://junglewise.ai/threats/cve-2025-67779-react-server-components-denial-of-service-via-incomplete-patch)