React fixes Flight flaw that enables unauthenticated code execution

CVE-2026-126187 is an unauthenticated remote code execution flaw in React Server Components’ Flight transport. The bug affects three bundler packages implementing Flight: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. React shipped fixes on 10 November 2026, with a CVSS of 9.5 (Critical).

The advisory notes that the vulnerability requires preconditions including a response that transports multiple typed arrays over a single shared ArrayBuffer, attacker-controlled bytes inside one view, and a consumer path transferring backing stores. Affected versions span 19.0.0 to 19.0.8, 19.1.0 to 19.1.9, 19.2.0 to 19.2.8, and 19.3.0; the corresponding fixed versions are 19.0.9, 19.1.10, 19.2.9, and 19.3.1.

The flaw enables arbitrary module execution from the application's own bundle via a corrupted Flight response, with server-side impact in SSR and edge rendering contexts. The article also notes that a related Flight flaw, CVE-2025-55182 (CVSS 10.0), was fixed in December 2025, marking this as the second serious Flight bug in twelve months. Not all React deployments are affected; client-only apps with no server, or apps without an RSC-capable framework or bundler, are not impacted.

The piece explains how Flight “talks” through rows, with text rows as line-delimited JSON and binary rows carrying typed arrays, and details the attack chain. It describes how a starved or mis-synced row can cause the parser to treat attacker-controlled bytes as executable module code, with the bug demonstrated in a lab reproduction.

To remediate, upgrades to fixed releases are advised: move every release line to a fixed version for the affected packages, verify resolutions in CI and on developer machines, and follow the guidance to copy shared buffers before rendering. The article also covers verification steps for npm dependencies, mitigation suggestions such as avoiding multiple views over one ArrayBuffer, and monitoring for specific corruption signatures in Flight responses.