React disclosed a critical remote-code-execution vulnerability in React Server Components on October 14, 2026; advisory GHSA-xqc2-xf4c-x3h3 gives it a CVSS v4 score of 9.5.

The flaw affects react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack, with affected releases spanning 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8 and 19.3.0; fixed versions are 19.0.9, 19.1.10, 19.2.9 and 19.3.1.

An attacker can exploit the vulnerability without an account or user interaction, and the potential impact on confidentiality, integrity and availability is rated high; the advisory does not say how widespread the required conditions are or claim that this flaw is being actively exploited.

Exploitation requires a specific response pattern involving multiple typed arrays and attacker-controlled data, so using React alone does not make an application vulnerable.

React recommends promptly updating affected packages and checking installed server-dom versions against the advisory; applications without server-side React code or without a framework, bundler or plugin that supports React Server Components are not affected.

The advisory lists no CVE identifier, and attacks reported against the separate React2Shell flaw, CVE-2025-55182, are not evidence that this newer vulnerability is being exploited.