React RSC RCE Gets CVE-2026-126187, So Re-Run Your Scanners

Update, 11 November 2026. This post first ran on 8 November 2026, when the flaw had no CVE id. GitHub added it to its global advisory database as CVE-2026-126187 on 10 November 2026, and we have rewritten the post around that change.

The critical React RSC RCE flaw first published as GHSA-xqc2-xf4c-x3h3 is now tracked as CVE-2026-126187. React fixed it on 14 October 2026 in react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel. Update to 19.0.9, 19.1.10, 19.2.9 or 19.3.1, whichever line your app tracks, as soon as you confirm the version.

What Changes Now That React RSC RCE Has a CVE Id

Until 10 November 2026, GitHub’s global advisory database had no entry for GHSA-xqc2-xf4c-x3h3, so tools that read that database could not flag it. The database now lists it as CVE-2026-126187, rated Critical, 9.5 on CVSS 4.0, and classed as CWE-502, deserialization of untrusted data. The CVE record reached NVD the same day.

Dependabot and npm audit read that database, so they can now flag the affected packages. A clean scan from before 10 November 2026 says nothing about this flaw, so run it again. Each fixed release’s own notes still say only “Improve transport protocol,” with no mention of security.

Our page on CVE-2026-126187 covers the advisory in full, including the same-day denial-of-service sibling GHSA-h3gv-c5rc-p453. CISA’s Known Exploited Vulnerabilities catalog did not list CVE-2026-126187 in its 10 November 2026 release.

Fixed Versions for React and Next.js

Next.js carries its own advisory, GHSA-673q-mjm6-r5xr. Both it and GHSA-xqc2-xf4c-x3h3 describe responses carrying multiple typed arrays and were published the same day, 14 October 2026; GHSA-673q is fixed in 16.4.1. On 3 November 2026 Vercel shipped seven more moderate advisories in 16.4.5 and 15.5.29. No source states that the Next 15 line carries the CVE-2026-126187 fix, so 15.5.29 is the current security release to target, not a confirmed fix for this specific flaw.

Vercel’s 3 November 2026 release also carried seven moderate advisories: CVE-2026-119346 through CVE-2026-119351, plus CVE-2026-119790. Between them they cover a cookie leak on Edge routes, an SVG rejection bypass, a response-injection path and four separate cache poisoning or disclosure issues in use cache. None of the seven reaches the critical rating of CVE-2026-126187. All seven landed in 16.4.5; only three of them — the cookie leak, the SVG bypass and the response-injection advisory — also landed in 15.5.29.

1. Check your lockfileSearch package-lock.json, yarn.lock or pnpm-lock.yaml for react-server-dom-webpack, react-server-dom-turbopack or react-server-dom-parcel, not just package.json.
2. Compare the versionVersions 19.0.0 to 19.0.8, 19.1.0 to 19.1.9, 19.2.0 to 19.2.8 and 19.3.0 are affected.
3. UpgradeMove to 19.0.9, 19.1.10, 19.2.9 or 19.3.1.
4. Check your framework tooNext.js apps should move to 16.4.5 or 15.5.29, the current security releases, and still verify the react-server-dom version directly.
5. Re-run your scannerDependabot and npm audit can flag CVE-2026-126187 since 10 November 2026. Treat a clean result from before that date as unchecked.

For the earlier, exploited React Server Components flaw, see our page on React2Shell (CVE-2025-55182). For the Next.js side, see our pages on the Next.js use cache RCE and the Next.js RCE patch check.