critical vulnerability

React: Unauthenticated Remote Code Execution in React Server Components

Fix availableCritical · CVSS 9.5

Published Nov 10, 2026 · updated Nov 10, 2026

What to do

Upgrade to a fixed version: react-server-dom-parcel 19.0.9, react-server-dom-parcel 19.1.10, react-server-dom-parcel 19.2.9, react-server-dom-parcel 19.3.1 (see table).
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmreact-server-dom-parcel24,930 downloads/week

Vulnerable versions: >= 19.0.0, < 19.0.9
Fixed in: 19.0.9

Check your project: npm ls react-server-dom-parcel --all

Is react-server-dom-parcel@19.0.9 safe to install? See the upgrade verdict →

npmreact-server-dom-parcel24,930 downloads/week

Vulnerable versions: >= 19.1.0, < 19.1.10
Fixed in: 19.1.10

Check your project: npm ls react-server-dom-parcel --all

Is react-server-dom-parcel@19.1.10 safe to install? See the upgrade verdict →

npmreact-server-dom-parcel24,930 downloads/week

Vulnerable versions: >= 19.2.0, < 19.2.9
Fixed in: 19.2.9

Check your project: npm ls react-server-dom-parcel --all

Is react-server-dom-parcel@19.2.9 safe to install? See the upgrade verdict →

npmreact-server-dom-parcel24,930 downloads/week

Vulnerable versions: >= 19.3.0, < 19.3.1
Fixed in: 19.3.1

Check your project: npm ls react-server-dom-parcel --all

Is react-server-dom-parcel@19.3.1 safe to install? See the upgrade verdict →

npmreact-server-dom-turbopack49,127 downloads/week

Vulnerable versions: >= 19.0.0, < 19.0.9
Fixed in: 19.0.9

Check your project: npm ls react-server-dom-turbopack --all

Is react-server-dom-turbopack@19.0.9 safe to install? See the upgrade verdict →

npmreact-server-dom-turbopack49,127 downloads/week

Vulnerable versions: >= 19.1.0, < 19.1.10
Fixed in: 19.1.10

Check your project: npm ls react-server-dom-turbopack --all

Is react-server-dom-turbopack@19.1.10 safe to install? See the upgrade verdict →

npmreact-server-dom-turbopack49,127 downloads/week

Vulnerable versions: >= 19.2.0, < 19.2.9
Fixed in: 19.2.9

Check your project: npm ls react-server-dom-turbopack --all

Is react-server-dom-turbopack@19.2.9 safe to install? See the upgrade verdict →

npmreact-server-dom-turbopack49,127 downloads/week

Vulnerable versions: >= 19.3.0, < 19.3.1
Fixed in: 19.3.1

Check your project: npm ls react-server-dom-turbopack --all

Is react-server-dom-turbopack@19.3.1 safe to install? See the upgrade verdict →

npmreact-server-dom-webpack3,463,835 downloads/week

Vulnerable versions: >= 19.0.0, < 19.0.9
Fixed in: 19.0.9

Check your project: npm ls react-server-dom-webpack --all

Is react-server-dom-webpack@19.0.9 safe to install? See the upgrade verdict →

npmreact-server-dom-webpack3,463,835 downloads/week

Vulnerable versions: >= 19.1.0, < 19.1.10
Fixed in: 19.1.10

Check your project: npm ls react-server-dom-webpack --all

Is react-server-dom-webpack@19.1.10 safe to install? See the upgrade verdict →

npmreact-server-dom-webpack3,463,835 downloads/week

Vulnerable versions: >= 19.2.0, < 19.2.9
Fixed in: 19.2.9

Check your project: npm ls react-server-dom-webpack --all

Is react-server-dom-webpack@19.2.9 safe to install? See the upgrade verdict →

npmreact-server-dom-webpack3,463,835 downloads/week

Vulnerable versions: >= 19.3.0, < 19.3.1
Fixed in: 19.3.1

Check your project: npm ls react-server-dom-webpack --all

Is react-server-dom-webpack@19.3.1 safe to install? See the upgrade verdict →

What changed

Nov 10, 2026
Published in the GitHub Advisory Database as critical.

Sources

CWE-502 Deserialization of Untrusted Data

← All critical vulnerabilities