React Server Components · Disclosed

Unauthenticated RCE in React Server Components has patches available

Nov 08, 2026 · 1 min read

Critical flaw GHSA-xqc2-xf4c-x3h3 in react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel allows unauthenticated remote code execution via crafted RSC Flight payload responses, according to Upwind. Fixes exist in 19.0.9, 19.1.10, 19.2.9 and 19.3.1, or via Next.js 16.4.1 or 15.5.28. Upwind recommends upgrading immediately; the source reports no active exploitation or public PoC.

By HIFY Radar newsroom Updated 11/08/2026 03:05 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A critical flaw (GHSA-xqc2-xf4c-x3h3) in React Server Components packages lets remote attackers run arbitrary code on servers without any credentials. The attack uses malicious RSC Flight payload responses. Upwind disclosed the alert and calls for immediate upgrades.

Why it matters

Applications using react-server-dom-webpack, react-server-dom-turbopack or react-server-dom-parcel in versions 19.0.0 through 19.3.0 are exposed to full remote server takeover. That can mean data theft, operational downtime and infrastructure compromise.

What to do

Upgrade immediately to 19.0.9, 19.1.10, 19.2.9 or 19.3.1, or to Next.js 16.4.1 or 15.5.28. Identify today which systems use the affected packages and at what version.

For the technical team

Affected: React Server Components (pacotes react-server-dom-webpack, react-server-dom-turbopack e react-server-dom-parcel) · react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel in versions 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8 and 19.3.0.
Exploitation: Disclosed by Upwind; the source reports no active exploitation, public PoC or KEV listing.
Fix: Upgrade to 19.0.9, 19.1.10, 19.2.9 or 19.3.1; alternative via Next.js 16.4.1 or 15.5.28.
Vector: Components react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel. Arbitrary code execution flaw exploitable remotely and without authentication, via crafted RSC Flight payload responses transporting multiple typed arrays and attacker-controlled values.
More details: Identifier GHSA-xqc2-xf4c-x3h3, rated critical by Upwind. Single source: Upwind alert (@UpwindMDR). No dates, IOCs or attack chain details cited.