React Product Security Update Advisory (CVE-2026-126187)
Overview
A security update has been released to address vulnerabilities in React products.
Affected Parties
- react-server-dom-webpack 19.0.0 or later but earlier than 19.0.9, 19.1.0 or later but earlier than 19.1.10, 19.2.0 or later but earlier than 19.2.9, 19.3.0.
- React-server-dom-parcel 19.0.0 or later but earlier than 19.0.9, 19.1.0 or later but earlier than 19.1.10, 19.2.0 or later but earlier than 19.2.9, 19.3.0.
- React-server-dom-turbopack 19.0.0 or later but less than 19.0.9, 19.1.0 or later but less than 19.1.10, 19.2.0 or later but less than 19.2.9, 19.3.0.
Vulnerability Description
- CVE-2026-126187 is an unauthenticated remote code execution vulnerability in React Server Components. – A threat actor could exploit this vulnerability to execute remote code without authentication.
Solutions
- You must update to the latest version that includes the Vulnerability Patch. – The affected versions are react-server-dom-webpack 19.0.9, 19.1.10, 19.2.9, and 19.3.1.
- The patched versions are react-server-dom-parcel 19.0.9, 19.1.10, 19.2.9, and 19.3.1.
- The affected versions are react-server-dom-turbopack 19.0.9, 19.1.10, 19.2.9, and 19.3.1.
Note
- [1] React: Unauthenticated Remote Code Execution in React Server Components.
- [2] Unauthenticated Remote Code Execution in React Server Components.
