Critical unauthenticated RCE in React Server Components, patched in 19.x point releases
DanielLockyer · x · 2026-11-09
React disclosed critical vulnerability GHSA-xqc2-xf4c-x3h3: an unauthenticated remote code execution flaw in react-server-dom-webpack, -turbopack and -parcel, exploitable via crafted RSC Flight payloads transporting multiple typed arrays plus attacker-controlled values.
- Affected: 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0
- Patched: 19.0.9, 19.1.10, 19.2.9, 19.3.1, or Next.js 16.4.1 / 15.5.28
- Immediate upgrade recommended
More from coding & agent
- DeepSeek says its Harness aims to be the OS of the agent era, with built-ins replaceable by plugins — dotey · 2026-11-09
- Claude Code Workflow Patches Vulnerable Dependencies One by One with Draft PRs — alex_verem · 2026-11-09
- Qwen quantized model on 16GB VRAM recreates Opus-style motion graphics in ~2 hours — Yhojm · 2026-11-09
- Claude Code writes ~265k lines in 3 weeks: open-source serverless P2P messenger over Tor — SayYoung530 · 2026-11-09
- Open-source Clean Development tool cleans up Claude Code session caches on macOS — Pathfinder-electron · 2026-11-09
- OpenAI details Pando, a Git-compatible backend built for Codex-scale development — rhiever · 2026-11-09