React Server Components unauthenticated remote code execution (GHSA-xqc2-xf4c-x3h3)

React's advisory says crafted payloads targeting frameworks that support React Server Components can lead to remote code execution. React describes the condition narrowly, limited to responses that transport multiple typed arrays together with one attacker-controlled value. React calls these "extremely rare cases" and recommends updating immediately.

How Does GHSA-xqc2-xf4c-x3h3 Lead to Remote Code Execution?

The fix sits in Flight, React's transport protocol for server components. Pull request #37846, titled "Improve transport protocol," changed 17 files and merged on 14 October 2026. Its description links three issues in a private mirror repository, so the technical root cause is not public.

The same-day advisory GHSA-h3gv-c5rc-p453 covers a separate denial-of-service condition in server function endpoints, rated 8.2 on CVSS 4.0, High. React says crafted HTTP requests to those endpoints can cause out-of-memory errors or excessive CPU use. The same four fixed versions close both advisories.

GitHub credits the finder of GHSA-xqc2-xf4c-x3h3 as the user evolutionstorm. The same user is credited as the finder of the same-day Next.js advisory, GHSA-673q-mjm6-r5xr.

There is no public report of exploitation in the wild found as of 8 Nov 2026. React's advisory does not state whether it has seen any attempted exploitation.

The advisory lists react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel as affected in versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8 and 19.3.0. All three packages share the same fixed versions.

npm's registry shows all four fixed versions published on 14 October 2026, within minutes of the advisory. React's advisory says an app is not affected if its React code does not use a server. An app is also not affected if its framework, bundler or bundler plugin does not support React Server Components.

Next.js has a same-day advisory, GHSA-673q-mjm6-r5xr, from Vercel. Both advisories describe responses that carry multiple typed arrays and were published the same day. GHSA-673q-mjm6-r5xr affects Next.js 16.0.0 through 16.4.0 and is fixed in 16.4.1.

Next.js also shipped seven moderate advisories on 3 November 2026, in Next.js 16.4.5 and 15.5.29. Neither those advisories nor the 15.5.29 release notes state that the Next 15 line carries the GHSA-xqc2-xf4c-x3h3 fix, so Next.js users should check their react-server-dom package version directly. See our page on the Next.js use cache remote code execution, GHSA-673q-mjm6-r5xr.