# React Server Components: critical remote code execution flaw

Canonical source : [React Server Components: critical remote code execution flaw](<https://sebastien.rigaux.be/en/tech-watch/links/react-server-components-critical-remote-code-execution-flaw>)

A critical vulnerability enables unauthenticated remote code execution in some applications using React Server Components. It affects `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in the versions listed in the advisory, with a CVSS score of 9.5.

The described scenario is rare: it requires responses that transport multiple typed arrays and an attacker-controlled value. React applications without a server are unaffected, as are applications that do not use a framework, bundler, or plugin supporting Server Components. Fixes are available in 19.0.9, 19.1.10, 19.2.9, and 19.3.1; affected deployments should upgrade immediately.

- Selected on : 2026-10-23

- Resource publication : 2026-10-14

- Entry updated : 2026-11-07T20:32:37+0000

- Format : Article

- Source language : EN

- Credit : mattcarrollcode

- Found via : [JavaScript Weekly](<https://javascriptweekly.com/>)

Original resource : [React Server Components: critical remote code execution flaw](<https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3?ck_subscriber_id=2550494205&utm_source=convertkit&utm_medium=email&utm_campaign=%E2%9A%9B%EF%B8%8F%20This%20Week%20In%20React%20%23302%3A%20Next.js%2C%20React%20Router%2C%20DevTools%2C%20Security%2C%20shadcn%2C%20Hydrogen%2C%20Vinext%2C%20Mutative%2C%20R3F%20%7C%20RN%200.88%2C%20Expo%2058%2C%20Navigation%2C%20FastImage%2C%20Screens%2C%20Device%20Hub%2C%20Edge%20to%20Edge%20%7C%20TypeScript%2C%20PHP%2C%20CrUX%2C%20Rsdoctor%2C%20Astro%20-%2023823401>)

Tags : [React Server Components](<https://sebastien.rigaux.be/en/tech-watch/tags/react-server-components>) · [React](<https://sebastien.rigaux.be/en/tech-watch/tags/react>) · [Security](<https://sebastien.rigaux.be/en/tech-watch/tags/security>)

Available versions : [Français](<https://sebastien.rigaux.be/veille/liens/react-server-components-une-execution-de-code-a-distance-critique>) · [English](<https://sebastien.rigaux.be/en/tech-watch/links/react-server-components-critical-remote-code-execution-flaw>)

[Back to tech watch](<https://sebastien.rigaux.be/en/tech-watch>)