React Server Components RCE: Critical Flaw GHSA-xqc2-xf4c-x3h3 Lets Attackers Run Code With No Login, and the Fixed Versions to Install

React disclosed a critical flaw on October 14, 2026 that can let an attacker with no login run their own code on the server behind a React website or app. If your company's site or customer portal is built with React and renders on a server, especially with Next.js, schedule this patch for this week.

The flaw is tracked as GHSA-xqc2-xf4c-x3h3. React says it only affects rare setups, but there is no workaround, and checking whether you qualify takes longer than installing the update.

What is the React Server Components vulnerability?

React Server Components let part of a React app run on the server and stream results to the browser. React's advisory says crafted payloads aimed at frameworks that support this feature can lead to remote code execution, meaning an outsider could run commands on your server.

The affected npm packages are react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack.

What is confirmed and what is not

Confirmed by React and Next.js:

• React published the advisory on October 14, 2026, rated Critical with a CVSS v4 score of 9.5.
• No login is needed, according to the advisory's title and its score.
• React says this "only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value." Typed arrays are a compact format for raw binary data.
• The advisory lists no workaround. Its only remedy is upgrading.
• The advisory shows "No known CVE", so it has a GitHub ID but no CVE number.
• The Next.js security post from the same day lists its own critical issue, GHSA-673q-mjm6-r5xr, and names the React advisory as its related upstream advisory.

Claimed, not verified:

• The exploit listing site Sploitus carries an entry dated November 8, 2026 for code it describes as a working proof of concept for this flaw. We did not run it and cannot say whether it works. If it does, the time to patch is shorter.

Not known:

• Whether anyone has used this in real attacks. React's advisory and the Next.js posts do not say, and we found no primary source reporting attacks as of November 8, 2026. That is not proof there have been none.
• How many live websites meet the conditions.
• What a compromise would look like. The advisories publish no warning signs to search for.

Is my React app affected?

React gives a clear way to rule yourself out: if your React code does not use a server, or you do not use a framework, bundler or plugin that supports React Server Components, you are not affected. A site that is purely browser-side React is outside this advisory.

You should check if you run Next.js with the App Router, or anything that depends on the three packages above. The October advisory names packages, not frameworks. React's December 2025 security post listed next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk as affected in that earlier incident, so those are sensible places to look.

On Next.js, the specific trigger is an App Router app with Cache Components where a use cache function returns multiple typed arrays. Next.js still says to "upgrade immediately even if your application does not have similar functions."

React and Next.js fixed versions

The last row matters because the same Next.js release fixed two other serious issues. CVE-2026-96889 is a critical code execution flaw in image optimization when Next.js runs on glibc-based Linux, listed from 10.0.0 onward. GHSA-p3m5-59mp-jv5r is a high severity denial of service in Server Actions, listed from 13.0.0 onward. Those advisories list fixes only in 15.5.28 and 16.4.1, so apps on older lines need to move up.

Next.js then shipped more fixes on November 3, 2026 in 16.4.5 and 15.5.29. Go straight to those.

React Server Components patch checklist for this week

1. List every React app you own, including marketing sites, portals and internal tools. Ask your developer or vendor if you are unsure.
2. Check versions. In each project, run npm ls next react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack.
3. Update. For Next.js, run npm install next@16.4.5 or npm install next@15.5.29. For other setups, move the package to a fixed version from the table.
4. Rebuild and redeploy. Changing a version number in a file protects nothing until the new build is live. Confirm the version on the running site.
5. Clear old deployments. Netlify notes that publicly available deploy previews and branch deploys "may remain vulnerable until they are automatically deleted" and suggests considering manual deletion. Check whether your host keeps similar copies.
6. Do not rely on CVE-based scanners alone. With no CVE number on the React advisory, tools that match only on CVE IDs may not flag it. Search for the GHSA ID or check versions directly.
7. If an affected app was exposed and unpatched, our advice is to review server logs for unexpected processes and outbound connections, and to plan a rotation of the secrets that server could read. This step is our recommendation, not part of the advisories.

Why this matters for a company website

A website server often holds more than web pages. It usually has database passwords, payment and email API keys, and a network path to other systems. Code execution on that server puts all of those within reach.

This flaw also sits in the plumbing. Your team may never have written code that mentions typed arrays, and your site can still ship the vulnerable package. If you run your own servers, the patch is your job from start to finish, and our self-hosting infrastructure page covers how to keep that manageable. If a platform hosts the app, do not assume it was handled for you: Netlify says apps that meet the conditions are affected on its platform and that upgrading Next.js resolves it.

React Server Components RCE questions people are asking

Is GHSA-xqc2-xf4c-x3h3 the same as CVE-2025-55182?

No. CVE-2025-55182 is an earlier React Server Components flaw from December 2025, fixed in 19.0.1, 19.1.2 and 19.2.1. This one needs the newer versions in the table above.

Does the React vulnerability have a CVE number?

Not on the advisory, which shows "No known CVE". Use the GHSA ID when searching.

Am I affected if React only runs in the browser?

No. React says apps whose React code does not use a server are not affected.

Is there a workaround for the React RCE?

React lists none, and Next.js says there is no known workaround for its related issue. Upgrade.

Has this React flaw been exploited?

We found no primary source reporting attacks as of November 8, 2026. An unverified proof of concept is listed publicly, so do not wait for confirmation.

Should I patch if I do not use use cache?

Yes. Next.js says to upgrade even without those functions, and the same release fixes other flaws that do not depend on them.

The bigger lesson

A lot of the risk in a modern website sits in the packages underneath it, not in the pages your team wrote. A fix can exist upstream and your site can stay exposed until someone rebuilds, redeploys and cleans up the old preview links. Knowing who owns that job matters as much as any single patch.

Want someone to own patching and hardening for your web apps? See security hardening or request a quote.

Get security alerts like this by email, with the free checklist, at security alerts.

Sources: React advisory GHSA-xqc2-xf4c-x3h3; Next.js October 14 security update; Next.js advisory GHSA-673q-mjm6-r5xr; Next.js advisory for CVE-2026-96889; Next.js advisory GHSA-p3m5-59mp-jv5r; Next.js November 2026 security release; React December 2025 security post; Netlify changelog.