External risk intelligence

React Server Components Unauthenticated Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-126187

The vulnerability affects React Server Components, a technology commonly used in modern web applications that expose public-facing web and API endpoints. While it requires specific configurations and frameworks, such deployments are frequently internet-facing by design to deliver dynamic server-rendered user interfaces.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in certain versions of React's server components that could allow unauthenticated remote code execution. This issue is highly specific and affects only rare configurations where multiple typed arrays are transported with an attacker-controlled value, and only when using frameworks that support React Server Components. Applications not using server-side React or specific frameworks are not impacted.

Unauthenticated code execution in specific React server setups.
Affects modern apps using server-side React components.
Confirm relevance; impact is limited to rare configurations.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted payloads to applications using specific React Server Component frameworks. This attack targets the way certain responses transport multiple typed arrays and attacker-controlled values, potentially leading to unauthenticated remote code execution. Applications not using React Server Components or those not relying on frameworks, bundlers, or bundler plugins that support them are not at risk.

Requires specific framework support.
Triggered by crafted payloads.
Leads to unauthenticated code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated remote code execution could occur in applications using React Server Components with specific frameworks, impacting service behavior. This vulnerability is only present in rare cases involving responses that transport multiple typed arrays and an attacker-controlled value.

System data may be affected.
Exposure could occur via crafted network payloads.
Service behavior could be altered.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts applications using React Server Components with specific framework and bundler configurations. Application owners, platform teams, and potentially vendor-management teams should collaborate to address this. The first practical step is to identify all instances of the affected React versions, confirm their exposure and criticality, and then prioritize remediation efforts based on risk.

Application owners should own the issue.
Verify if React Server Components are used.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is React, and why is this vulnerability relevant to it?

React is a JavaScript library used to build user interfaces. While React is widely known for browser-side rendering, this issue involves its server-side capabilities. Specifically, it affects packages like react-server-dom-webpack that enable React Server Components, which allow developers to render components on the server before sending them to the client. The bug concerns how these server-rendered components process data during network transmission.

What is the vulnerability class for CVE-2026-126187?

This vulnerability is classified as CWE-502: Deserialization of Untrusted Data. In simple terms, this means the software incorrectly handles incoming data, allowing an attacker to supply malicious input that the application then treats as trusted code. For this CVE, it specifically enables unauthenticated remote code execution, where a sender can force the server to execute arbitrary commands by submitting a specially crafted payload.

How can an attacker trigger this vulnerability?

The attack requires sending a crafted payload to an application that uses specific frameworks, bundlers, or plugins supporting React Server Components. The flaw is not universal; it only triggers in rare scenarios where the system handles multiple typed arrays combined with an attacker-supplied value. If your application does not use React Server Components, or if you are not using frameworks that leverage these specific server-side rendering packages, this vulnerability cannot be triggered.

Who should care about this React vulnerability?

Developers and organizations using React Server Components should prioritize this. Halo Surface Signal notes that this technology is common in modern web applications that expose public-facing endpoints to provide dynamic interfaces. Because these services are often intentionally internet-facing to handle traffic, they are more likely to be accessible to unauthorized parties, making assessment of your framework's architecture critical.

What are the first steps to fix this in my environment?

Begin by auditing your project dependencies to determine if you are using an affected version of React. Confirm whether your application architecture utilizes React Server Components through frameworks, bundlers, or plugins. If you confirm usage, prioritize updating your packages to the patched versions—19.0.9, 19.1.10, 19.2.9, or 19.3.1—depending on your current branch. Coordinate this transition within your standard maintenance cycles.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.