React Server Components Vulnerability GHSA-xqc2-xf4c-x3h3: Critical Code Execution Flaw Hits Next.js 16 Cache Components, and the Fixed Versions to Install

A critical flaw in React Server Components, the server-side part of React used by Next.js and other frameworks, can let an attacker with no login run code on the web server behind a site. It only works in rare app patterns. The fix is a routine update, and if your website or web app runs on Next.js 16 or another React Server Components framework, check this week that the update has reached your live site.

What happened

On Wednesday, October 14, 2026, the React team published advisory GHSA-xqc2-xf4c-x3h3, titled "Unauthenticated Remote Code Execution in React Server Components." It is rated Critical, with a CVSS v4 score of 9.5. The same day, Next.js released an out-of-band security update that included a matching Next.js advisory, GHSA-673q-mjm6-r5xr, also scored 9.5. Both advisories credit a researcher who goes by evolutionstorm.

News sites are covering the story again in November, but the patches have been out since October 14. So if your team saw it in the news this week, don't ask whether a fix exists. Ask whether you installed it.

What is confirmed, and what is not

Confirmed by the advisories:

• The flaw is in three npm packages: react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel.
• The attacker needs no account and no user interaction. React's advisory says "crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution."
• It is narrow. React says it "only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value." Typed arrays are how JavaScript holds raw binary data, such as the bytes of a file or an image.
• In Next.js, the risk applies to apps using the App Router with Cache Components, where a use cache function returns multiple typed arrays.
• There is no workaround. Both advisories say to upgrade, and Next.js says to upgrade "even if your application does not have similar functions."
• Apps with no server, and apps that do not use a framework, bundler or bundler plugin that supports React Server Components, are not affected.

Not known or not stated:

• No CVE number has been assigned. Both advisories list "no known CVE."
• Neither advisory reports attacks in the wild, and neither publishes exploit details.
• Nobody has said how many sites contain the risky code pattern. "Extremely rare" is React's own description, not a measured count.

Who is affected

Websites and web apps built with React Server Components. In practice that mostly means Next.js 16 sites using the App Router, plus other frameworks and bundler plugins that support React Server Components. A plain React app that only runs in the browser is not affected, and neither is a WordPress or Wix site.

If an agency or freelancer built your site, you may not know which framework it uses. Ask them that first.

Fixed versions to install

The Next.js advisory lists 16.4.1 as the only patched release, so sites on Next.js 16.0 to 16.3 have to move up to 16.4. On November 3, 2026, Next.js shipped another security release (16.4.5 and 15.5.29) that fixes several cache and data-exposure issues. That makes the latest release in your line a better target today than the minimum.

The October 14 Next.js update also fixed a second critical flaw, CVE-2026-96889, in image optimization when Next.js runs on glibc-based Linux, plus a high-severity denial-of-service flaw in Server Actions. That is why Next.js 15.5 sites should update too, even though the React flaw is only listed for Next.js 16.

What to do this week

1. List your React Server Components apps. Ask your developer, or look in each project's package.json for next or any react-server-dom- package.
2. Check installed versions. In each project, run npm ls next react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel and compare the output with the table above.
3. Update and commit the lockfile. For Next.js, the release notes give npm install next@16.4.5 or npm install next@15.5.29. Commit the updated package-lock.json (or yarn or pnpm lockfile).
4. Rebuild and redeploy. A new version in the repository does nothing until the live server runs the new build. We wrote about this gap in Updated Is Not the Same as Patched.
5. Confirm production. Check the deployed build's log or dependency list, not just a developer's laptop.
6. Find the risky pattern. Ask whether any use cache function returns binary data such as Uint8Array values. If one does, update that app first and keep its server logs. The advisories publish no signs of compromise to look for.

Why this matters for a business website

Remote code execution on a web server is about as serious as a website flaw gets. The server that renders your pages often also holds database passwords, payment and email API keys, and access to customer records. Someone who can run code there can usually reach all of it.

Modern JavaScript frameworks hide the server, which makes it easy to assume there is nothing to patch. There is. A framework pulls in dozens of packages, and a fix in one of them only protects you after someone updates, rebuilds and redeploys. If no one is named as responsible, it tends not to happen. We covered that ownership question in Who Is Patching the Software That Runs Your Business?. If you run Next.js on your own servers, the operating system and Node.js runtime need the same attention, which is what self-hosting infrastructure work covers.

React Server Components vulnerability questions people are asking

Is my Next.js site vulnerable to GHSA-xqc2-xf4c-x3h3?

Only Next.js 16.0.0 to 16.4.0 is listed. The risk applies to App Router apps with Cache Components where a use cache function returns multiple typed arrays. Update to 16.4.1 or later either way, because there is no workaround.

Is there a CVE for the React Server Components flaw?

No. Both advisories list "no known CVE." Track it as GHSA-xqc2-xf4c-x3h3 for React and GHSA-673q-mjm6-r5xr for Next.js.

Is the React Server Components flaw being exploited?

Neither advisory reports exploitation in the wild or publishes an exploit.

Is this the same as the December 2025 React Server Components flaw?

No. Next.js published a separate advisory for that one, CVE-2025-66478, on December 3, 2025. The October 2026 advisory is a new issue with different conditions.

Does a plain React app need this update?

If it runs only in the browser and does not use React Server Components, React says it is not affected.

Does my hosting provider protect me?

The advisories do not say any host protects you. The fix lives in your app's dependencies, so update and redeploy wherever the app runs.

The bigger lesson

Frameworks like Next.js fix security issues often, and the patch is usually ready before the headline appears. Whether a business is exposed comes down to whether someone checks versions, updates the lockfile and redeploys within days. Give that job a named owner for every site and app you run.

Want that job owned and done? See security hardening or get a quote.

Get security alerts like this one by email, with our free checklist, at security alerts.

Sources: React advisory GHSA-xqc2-xf4c-x3h3; Next.js advisory GHSA-673q-mjm6-r5xr; Next.js October 14, 2026 security update; Next.js November 2026 security release.