React Server Components typed-array RCE

What it means for your AI agents

Anything your agents can reach is part of their attack surface. A critical flaw in a system an agent calls can turn the agent's own access into the attacker's.

• List the agents and tools that reach the affected systems.
• Rotate the credentials those agents use if an affected system was exposed.
• Treat output from an unpatched system as untrusted input to your agents.

Updates

• Nov 10, 2026 : The React advisory was assigned CVE-2026-126187 and added to the GitHub Advisory Database, so npm audit and Dependabot now flag affected react-server-dom packages.
• Oct 22, 2026 : GitHub added the Next.js advisory to its Advisory Database, so npm audit now flags affected next versions.
• Oct 17, 2026 : Hash Security published an analysis and a lab proof of concept.
• Oct 14, 2026 : React and Next.js published advisories and fixed releases.

Details

React Server Components send data between server and client in a format called Flight.

According to Hash Security's analysis, the trigger is several large typed arrays that share one underlying buffer. The writer then frames the stream incorrectly, and the reader can treat attacker-controlled bytes as protocol rows that call a Server Action with arguments the attacker chooses. Command execution needs a Server Action that does something dangerous with those arguments. React's fix changes how such typed arrays are written.

In Next.js, the path is an App Router app with Cache Components and a use cache function that returns several typed arrays. Versions 16.0.0 to 16.4.0 are affected. Next.js 15 is not listed in the advisory, but 15.5.28 includes React's transport protocol fix and a separate critical image optimization fix (CVE-2026-96889).

React describes the affected cases as extremely rare, and Vercel says there is no workaround.

On November 10, the React advisory was assigned CVE-2026-126187 and added to the GitHub Advisory Database, so npm audit and Dependabot now flag affected react-server-dom packages. The Next.js advisory has no CVE ID.

Risk

An unauthenticated attacker can run code in rare apps whose RSC payloads mix several typed arrays with attacker input. Public proof-of-concept code exists; React, Vercel and CISA had not reported exploitation as of November 11.

Affected deployments

Next.js 16.0.0–16.4.0 apps that use the App Router with Cache Components. Also other RSC frameworks or bundler setups with react-server-dom-webpack, -turbopack or -parcel 19.x before 19.0.9, 19.1.10, 19.2.9 or 19.3.1. Next.js 15.5 is not listed in the advisory, but 15.5.28 includes React's transport fix, so update 15.5 apps too. Apps that don't render React on a server are not affected.

Recommended action

Update Next.js to 16.4.1 or later (15.5.28 on 15.x) or react-server-dom-* to a fixed 19.x release, then check the deployed version. Updating React alone does not fix Next.js.

1. 1Find apps that use React Server Components. Check lockfiles for next and the react-server-dom-* packages, including monorepo workspaces and container images.
2. 2Update Next.js 16 apps to 16.4.1 or later, and Next.js 15.5 apps to 15.5.28 or later. Next.js ships its own compiled copy of the RSC packages, so the fix only arrives through the next package. Next.js advisory

Next.js security update ↗

1. 1For other RSC frameworks or custom bundler setups, update react-server-dom-* to 19.0.9, 19.1.10, 19.2.9 or 19.3.1, or to the framework release that includes them. React advisory
2. 2Rebuild and redeploy, then check the version in the deployed image or artifact, for example node_modules/next/package.json. A fixed lockfile alone does not show that the fix is running.

Use this prompt with an agent that can inspect your infrastructure.

Check your exposure with an agent

Paste this into an AI agent that can see your infrastructure. It asks for a read-only check of what's affected, including the systems behind your agents, and a table you can act on. Copying it changes nothing.

Assess whether the infrastructure you can access is affected by React Server Components typed-array RCE (CVE-2026-126187 and CVE-2026-96889). Work read-only within your authorized access: do not run exploits, change configuration, restart services or install anything.

1. Confirm the affected and fixed versions from the vendor advisories and CVE records:
   - https://nextjs.org/blog/nextjs-security-update-october-14-2026
   - https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3
   - https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr
   - https://github.com/react/react/pull/37845
   - https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f
   - https://github.com/vercel/next.js/commit/a2021b3e50527eb3d324c21455faabbd813066e9
   Cite each source and the date you read it. Say plainly what you could not verify.

2. Inventory the systems that could run the affected software, including the hosts, containers, MCP servers, tool runners and sandboxes behind any AI agents. For each, record the asset, environment, owner if known and the version actually running, from read-only evidence (package metadata, version commands, platform inventory).

3. Note which affected systems are reachable from the internet or from agents and tools, and which credentials (model-provider keys, tool tokens, service accounts) are stored on them.

4. Report one row per asset: asset, running version, affected (yes / no / unknown), reachable from, credentials at risk, evidence, and the next step. List anything you could not access as a gap rather than assuming it is safe.