Critical React Server Components Vulnerability Allows Unauthenticated Attackers to Execute Malicious Code on Servers

A critical vulnerability in React Server Components, tracked as GHSA-xqc2-xf4c-x3h3 with a CVSS v4.0 score of 9.5, could allow unauthenticated attackers to execute malicious code on affected servers through crafted payloads, according to an advisory released on October 14, 2026. The flaw affects the react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack packages across several 19.x version ranges, and maintainers list fixed versions 19.0.9, 19.1.10, 19.2.9 and 19.3.1, urging immediate upgrades.