A critical flaw in React Server Components could let unauthenticated attackers run code on affected servers, React has warned in a security advisory tracked as GHSA-xqc2-xf4c-x3h3. The issue carries a CVSS v4 score of 9.5, the highest severity band, and React urges affected users to update immediately.

The flaw affects the react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack packages in versions 19.0.0 to 19.0.8, 19.1.0 to 19.1.9, 19.2.0 to 19.2.8 and 19.3.0. Fixed releases are 19.0.9, 19.1.10, 19.2.9 and 19.3.1. Next.js is also affected: versions 16.0.0 to 16.4.0 carry the same bug, fixed in Next.js 16.4.1 under a separate advisory, GHSA-673q-mjm6-r5xr.

Exploitation requires an extremely rare response pattern: a server response carrying multiple typed arrays alongside an attacker-controlled value. In Next.js that means a cache function returning typed arrays. React says applications without server-side React code, or without a framework or bundler that supports Server Components, are not affected.

The advisory carries no CVE identifier, and no exploitation in the wild has been reported. It is a different flaw from React2Shell, the CVE-2025-55182 vulnerability in the same packages that attackers exploited at scale in December 2025. Vercel says there is no workaround and advises upgrading even if an app has no affected functions, and warns that upgrading React alone does not fix Next.js, because the framework ships its own copy of the affected code.