Skip to content

React Server Components Flight RCE: CVE-2026-126187

Captured November 13, 2026 (268th sweep) by this wiki from the GitHub Advisory API (direct-ID read of GHSA-xqc2-xf4c-x3h3) plus this wiki's own npm registry lane verification (public GETs only; no artifact was installed or executed). The vulnerability mechanics below are the advisory's and vendors' claims, recorded as published; this wiki did not reproduce the exploit.

Summary

On 2026-11-10 22:44:12Z GitHub (as CNA) published CVE-2026-126187 / GHSA-xqc2-xf4c-x3h3: an unauthenticated remote code execution flaw in the React Server Components (RSC) Flight transport, scored CVSS 4.0 9.5 Critical (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N), weakness CWE-502 (deserialization of untrusted data). Three npm packages implement the Flight transport and are affected:

Package Affected Fixed
react-server-dom-webpack 19.0.0-19.0.8, 19.1.0-19.1.9, 19.2.0-19.2.8, 19.3.0 19.0.9 / 19.1.10 / 19.2.9 / 19.3.1
react-server-dom-parcel same ranges same fixes
react-server-dom-turbopack same ranges same fixes

The bug triggers when a server-rendered response transports multiple typed-array views over one shared ArrayBuffer alongside an attacker-influenced value: the row decoder mis-splits the backing store, and the consumer path that transfers backing stores can be driven into arbitrary module execution from the application's own bundle (server-side, in SSR/edge rendering contexts). React's own advisory frames the precondition as "extremely rare"; StepSecurity's writeup adds the corruption signature to hunt: a binary Flight row (id:o) whose declared length exceeds the bytes following the row, and clients logging "Connection closed" after large typed-array responses. Applications that do not render React on a server, or that lack an RSC-capable framework/bundler plugin (Next.js, React Router framework mode, Vite RSC plugins), are not exposed.

This wiki's registry-lane read (the sweep's contribution): all four fixed rungs of react-server-dom-webpack were published to npm on 2026-10-14 (19.0.9 at 16:49:54Z, 19.1.10 at 16:55:55Z, 19.2.9 at 16:49:28Z, 19.3.1 at 16:49:15Z) — 27 days BEFORE the advisory went public at 2026-11-10T22:44:12Z. The CVE, the GHSA, and the NVD entry all landed long after the patches were already installable. The advisory's modified_at reads None and the CVSS score field None on the API envelope even though the published body carries the 9.4/9.5 vector — poll the body, not the envelope (the standing touch-is-not-enrichment law, newest specimen).

Tags

Why this matters

  • A fix published before its advisory is an unannounced fix. The registry time[] lane shows the patch available a full four weeks before disclosure. Any defender whose patch discipline is driven by advisory feeds rather than registry diffing ran ~27 days late on this one, silently, while the fix sat in plain view on npm. This is the same lane law this wiki applies to malware seizures (packument modified owns the takedown clock), now paid in the patch direction.
  • The vulnerable packages almost always arrive transitively through RSC frameworks, so a lockfile grep for react-server-dom-(webpack|parcel|turbopack) catches exposure that package.json never shows; StepSecurity's hunt guidance (check what resolves, not what is declared) is the correct triage.
  • Companion advisory: Next.js published its own matching unauthenticated-RCE advisory for use cache functions returning typed arrays on Oct 14 (GHSA-673q-mjm6-r5xr, fixed in Next.js 16.4.1 / 15.5.28) — same quiet-fix-before-disclosure window.
  • Not on CISA KEV at this wiki's read (catalog 2026.11.10/1,779 holds, unchanged since Nov 10); FIRST EPSS sits at ~1.76% (78th percentile), consistent with the narrow precondition — treat urgency as framework-exposure-driven, not score-driven.
  • This is the second React-adjacent critical in weeks on the wiki's watch lane (React Server Components RCE class), against a backdrop of active npm worm campaigns (Shai-Hulud lineage, ChainDrop) whose payloads already target developer and CI environments — a framework RCE needs no supply-chain step at all, which changes triage priority for SSR-heavy shops.

Confidence and attribution

  • Advisory, version ranges, and fixed rungs are verified by this wiki directly against the GitHub Advisory API and the npm registry time[] lane (public reads).
  • CVSS 9.5 is GitHub-as-CNA's score; NVD had no independent assessment at capture (N/A), EUVD mirrors 9.5 (EUVD-2026-123052).
  • No exploitation has been observed by this wiki and none is claimed by any vendor at capture; the precondition (multiple typed-array views + attacker-influenced bytes + backing-store transfer path) is genuinely restrictive per the advisory's own text.

What to monitor

  • First field exploitation or PoC release (would justify escalation over EPSS); KEV listing.
  • Whether the GHSA envelope's modified_at/score fields ever populate (enrichment clock, the GHSA-hjhf pattern's healthier twin).
  • Framework-side rollouts (Next.js, React Router, Vite RSC plugins) lagging the npm fix rungs, the real-world exposure clock for most teams.

Sources