CVE-2026-126187

Name of the Vulnerable Software and Affected Versions react-server-dom-webpack versions 19.0.0 through 19.0.8 react-server-dom-webpack versions 19.1.0 through 19.1.9 react-server-dom-webpack versions 19.2.0 through 19.2.8 react-server-dom-webpack version 19.3.0 react-server-dom-parcel versions 19.0.0 through 19.0.8 react-server-dom-parcel versions 19.1.0 through 19.1.9 react-server-dom-parcel versions 19.2.0 through 19.2.8 react-server-dom-parcel version 19.3.0 react-server-dom-turbopack versions 19.0.0 through 19.0.8 react-server-dom-turbopack versions 19.1.0 through 19.1.9 react-server-dom-turbopack versions 19.2.0 through 19.2.8 react-server-dom-turbopack version 19.3.0 Next.js versions prior to 15.5.28 Next.js versions prior to 16.4.1

Description Unauthenticated remote code execution is possible in frameworks supporting React Server Components due to a desynchronization bug in React Flight serialization. The issue occurs when responses transport multiple typed arrays sharing an underlying buffer and an attacker-controlled value, specifically affecting configurations using Next.js Cache Components (use cache). An attacker can use a crafted HTTP GET request to exploit detached ArrayBuffer views and incorrect length framing, turning a deserialization over-read into a Server Action invocation. Applications that do not use a server or a framework, bundler, or plugin supporting React Server Components are not affected.

Recommendations Update react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack to versions 19.0.9, 19.1.10, 19.2.9, or 19.3.1. Update Next.js to version 15.5.28 or 16.4.1.