CVE-2026-126187

What's affected. The npm packages react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel, versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0. Fixed versions are 19.0.9, 19.1.10, 19.2.9 and 19.3.1, all published to npm on October 14, 2026.

Next.js. Vercel's matching advisory GHSA-673q-mjm6-r5xr covers Next.js 16.0.0 through 16.4.0 and is fixed in 16.4.1 (published October 14, 2026). Vercel says the issue affects apps using the App Router with Cache Components that have a use cache function returning multiple typed arrays, and tells all Next.js 16 users to upgrade even if they have no such function.

Not affected, per React. Apps whose React code does not use a server, and apps that do not use a framework, bundler or bundler plugin that supports React Server Components.

What it is. React Server Components send data between the server and the client using React's own transport format. React says crafted payloads aimed at frameworks that support Server Components can lead to remote code execution, but only where responses transport multiple typed arrays (binary arrays such as Uint8Array) and an attacker-controlled value. The CVSS vector's AT:P means an attack requirement must be present, which matches React's "extremely rare cases" wording.

Checks, in three tiers. The first decides exposure. The second and third decide priority. Run these only on systems your organization owns.

1. Do you run an affected package or Next.js version? This decides exposure. For apps that depend on the packages directly, run npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel (pnpm: pnpm why react-server-dom-webpack; Yarn: yarn why react-server-dom-webpack). For Next.js apps, run npm ls next. Next.js ships its own copy of the React Server Components packages inside the next package (in our inspection of the Next.js 16.4.0 package, under next/dist/compiled/), so npm ls react-server-dom-webpack can come back empty on a vulnerable Next.js app. The Next.js version is what counts there. Anything from 16.0.0 through 16.4.0 is affected. Also check lockfiles across repositories and the SBOMs or images of deployed containers, since a fixed lockfile does not help if an older image is still running.
2. Can untrusted networks reach the app's server? A server-rendered app that answers from the internet goes first. Internal apps behind SSO or a VPN still matter, but less.
3. Does the app have the rare pattern React and Vercel describe? React says only responses that carry multiple typed arrays plus an attacker-controlled value are affected. For Next.js, Vercel names use cache functions that return multiple typed arrays. Developers can search for use cache directives and Server Component or Server Action code that returns binary arrays. Treat this tier as priority only. Vercel says to upgrade even if you find no such function, and a code search can miss cases.

Identities involved. Code execution would run as the account the Node.js server runs as, with whatever cloud role, environment variables and secrets that process holds. Check what that runtime identity can reach.

React and Vercel have published no workaround. Vercel says there is no known workaround, and React lists none. Upgrading is the fix.

React and Vercel publish no indicators of compromise. General signals to review on affected app servers are below.

• The Node.js server process starting a shell or another child process your app does not normally start.
• Outbound connections from app servers that do not match normal traffic or deploys.
• New or changed executable files on app hosts or in running containers.

Am I exposed to CVE-2026-126187?

Only if you run React on a server with a framework or bundler that supports React Server Components, using react-server-dom-webpack, react-server-dom-turbopack or react-server-dom-parcel 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8 or 19.3.0, or Next.js 16.0.0 through 16.4.0. React says client-only apps are not affected, and only rare response patterns are exploitable.

Is there a patch for CVE-2026-126187?

Yes. React released 19.0.9, 19.1.10, 19.2.9 and 19.3.1 on October 14, 2026. Next.js users should move to 16.4.1 or later.

Is CVE-2026-126187 being exploited?

No exploitation has been reported by React, Vercel or CISA, and it is not on CISA's KEV catalog as of November 10, 2026. A public proof of concept was published on November 8.

How do I mitigate CVE-2026-126187 without patching?

Vercel says there is no known workaround, and React lists none. Upgrading is the fix.

Why does npm ls show nothing on my Next.js app?

Next.js ships its own copy of the React Server Components packages inside the next package, so check the Next.js version instead. 16.0.0 through 16.4.0 is affected and 16.4.1 is fixed.

Nov 10, 2026. First published. React fixed the flaw on October 14; the CVE was assigned November 10; a public proof of concept exists and no exploitation has been reported.

• React security advisory GHSA-xqc2-xf4c-x3h3 (published Oct 14, 2026; CVE added Nov 10, 2026)
• Next.js security advisory GHSA-673q-mjm6-r5xr (Oct 14, 2026)
• CVE record CVE-2026-126187 (published Nov 10, 2026)
• NIST NVD: CVE-2026-126187 (Received, no NVD score, checked Nov 10)
• npm: react-server-dom-webpack and npm: next (release dates of fixed versions)
• CISA Known Exploited Vulnerabilities catalog (not listed, checked the November 10, 2026 catalog release)