A critical vulnerability enables unauthenticated remote code execution in some applications using React Server Components. It affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack in the versions listed in the advisory, with a CVSS score of 9.5.
The described scenario is rare: it requires responses that transport multiple typed arrays and an attacker-controlled value. React applications without a server are unaffected, as are applications that do not use a framework, bundler, or plugin supporting Server Components. Fixes are available in 19.0.9, 19.1.10, 19.2.9, and 19.3.1; affected deployments should upgrade immediately.
mattcarrollcodeFound via JavaScript Weekly
