Kritisch 9.5Software
CVE-2026-126187
React: Unauthenticated Remote Code Execution in React Server Components
react-server-dom-parcel, react-server-dom-parcel, react-server-dom-parcel
### Impact Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Updating immediately is recommended. The vulnerability exists in versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8 and 19.3.0 of: - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack…
10. Nov 2026
Original bei NVD öffnen