CVE-2026-126187

CVE-2026-126187 is a critical unauthenticated remote code execution vulnerability in React Server Components' Flight protocol, with a CVSS 4.0 score of 9.5. The flaw stems from improper handling of typed arrays in shared ArrayBuffers during serialization, allowing attackers to smuggle malicious module rows into the stream by exploiting a framing bug. When a response carries multiple typed-array views over a shared buffer and an attacker controls part of the data, a corrupted Flight row can cause the parser to execute arbitrary modules from the application's bundle. The vulnerability affects React Server Components implementations in react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack across multiple version ranges, with fixes released on November 10, 2026.