React's advisory rates it 9.5 on CVSS 4.0 and names react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel as affected. The react/react repository published the advisory, and fixed versions, on 14 October 2026. GitHub added it to its global advisory database with the CVE id on 10 November 2026.
What it allows
React's advisory says crafted payloads targeting frameworks that support React Server Components can lead to remote code execution. React describes the condition narrowly, limited to responses that transport multiple typed arrays together with one attacker-controlled value. React calls these "extremely rare cases" and recommends updating immediately.
How Does CVE-2026-126187 Lead to Remote Code Execution?
The fix sits in Flight, React's transport protocol for server components. Pull request #37846, titled "Improve transport protocol," changed 17 files and merged on 14 October 2026. Its description links three issues in a private mirror repository, so the technical root cause is not public. GitHub's advisory database classifies the flaw as CWE-502, deserialization of untrusted data.
The same-day advisory GHSA-h3gv-c5rc-p453 covers a separate denial-of-service condition in server function endpoints, rated 8.2 on CVSS 4.0, High. React says crafted HTTP requests to those endpoints can cause out-of-memory errors or excessive CPU use. The same four fixed versions close both advisories.
GitHub credits the finder of CVE-2026-126187 as the user evolutionstorm. The same user is credited as the finder of the same-day Next.js advisory, GHSA-673q-mjm6-r5xr.
CISA's Known Exploited Vulnerabilities catalog did not list CVE-2026-126187 in its 10 November 2026 release. React's advisory does not state whether it has seen any attempted exploitation.
Who is affected
The advisory lists react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel as affected in versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8 and 19.3.0. All three packages share the same fixed versions.
npm's registry shows all four fixed versions published on 14 October 2026, within minutes of the advisory. React's advisory says an app is not affected if its React code does not use a server. An app is also not affected if its framework, bundler or bundler plugin does not support React Server Components.
Next.js has a same-day advisory, GHSA-673q-mjm6-r5xr, from Vercel. Both advisories describe responses that carry multiple typed arrays and were published the same day. GHSA-673q-mjm6-r5xr affects Next.js 16.0.0 through 16.4.0 and is fixed in 16.4.1.
Next.js also shipped seven moderate advisories on 3 November 2026, in Next.js 16.4.5 and 15.5.29. Neither those advisories nor the 15.5.29 release notes state that the Next 15 line carries the CVE-2026-126187 fix, so Next.js users should check their react-server-dom package version directly. See our page on the Next.js use cache remote code execution, GHSA-673q-mjm6-r5xr.
Timeline
- 14 Oct 2026
React publishes GHSA-xqc2-xf4c-x3h3 and the same-day DoS advisory GHSA-h3gv-c5rc-p453 in the react/react repository. Fixed versions 19.0.9, 19.1.10, 19.2.9 and 19.3.1 reach npm the same day.
- 14 Oct 2026
About 39 minutes later, Vercel publishes the Next.js twin advisory GHSA-673q-mjm6-r5xr and Next.js 16.4.1.
- 3 Nov 2026
Vercel publishes Next.js 16.4.5 and 15.5.29 with seven moderate advisories; none states it carries the GHSA-xqc2-xf4c-x3h3 fix.
- 8 Nov 2026
A request to GitHub's global advisory-lookup API for GHSA-xqc2-xf4c-x3h3 returns no record (our own check).
- 10 Nov 2026
GitHub adds the advisory to its global advisory database as CVE-2026-126187, rated Critical and classed as CWE-502. The CVE record reaches NVD the same day.
What to do
-
Find the Affected React Packages
Check your lockfile, not just package.json, for react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel. Versions 19.0.0 to 19.0.8, 19.1.0 to 19.1.9, 19.2.0 to 19.2.8 and 19.3.0 are affected.
-
Upgrade to the Fixed Version
Move to 19.0.9, 19.1.10, 19.2.9 or 19.3.1, whichever line your app already tracks. All four were published to npm on 14 October 2026.
-
Check Your Framework Separately
Next.js apps should also move to 16.4.5 or 15.5.29, the current security releases. No source states that the Next 15 line carries this React-side fix, so verify your react-server-dom version directly rather than trusting the Next.js version alone.
-
Re-Run Dependabot and npm Audit
Since 10 November 2026 GitHub's global advisory database lists the flaw as CVE-2026-126187, so tools that read that database can now flag it. Re-run your scans and treat any clean result from before that date as unchecked.
-
Patch the Same-Day DoS Advisory Too
GHSA-h3gv-c5rc-p453 is a separate denial-of-service flaw in server function endpoints, fixed by the same four releases. One upgrade closes both advisories.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
Does GHSA-xqc2-xf4c-x3h3 have a CVE id?
Yes, since 10 November 2026: CVE-2026-126187. GitHub's global advisory database lists it under that id, and the CVE record reached NVD the same day. Until then the react/react repository advisory listed no CVE id.
Which React packages and versions does CVE-2026-126187 affect?
react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel, in versions 19.0.0-19.0.8, 19.1.0-19.1.9, 19.2.0-19.2.8 and 19.3.0. Update to 19.0.9, 19.1.10, 19.2.9 or 19.3.1.
Is CVE-2026-126187 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog did not list CVE-2026-126187 in its 10 November 2026 release, and React's advisory does not say whether it has seen exploitation.
Is CVE-2026-126187 the same bug as the Next.js use cache RCE?
No. Both describe responses that carry multiple typed arrays and were published the same day, but they are separate advisories in separate repositories, and neither names the other.
What should Next.js users check?
Update to Next.js 16.4.5 or 15.5.29, the current security releases, and separately verify the react-server-dom package version. No source states that these Next.js releases carry the CVE-2026-126187 fix.
Sources
- GHSA-xqc2-xf4c-x3h3, Unauthenticated Remote Code Execution in React Server Componentsreact/react on GitHub
- GHSA-h3gv-c5rc-p453, Denial of Service in Server Functionsreact/react on GitHub
- React v19.3.1 release notesreact/react on GitHub
- GHSA-673q-mjm6-r5xr, Unauthenticated Remote Code Execution in use cache functions returning typed arraysvercel/next.js on GitHub
- Next.js v16.4.5 release notesvercel/next.js on GitHub
- CVE-2026-126187NVD
- GHSA-xqc2-xf4c-x3h3, React: Unauthenticated Remote Code Execution in React Server ComponentsGitHub Advisory Database
