Critical Severity
Published: Nov 10, 2026
Unauthenticated RCE in React Server Components - PoC and Docker lab for GHSA-xqc2-xf4c-x3h3 / GHSA-673q-mjm6-r5xr
# GHSA-xqc2-xf4c-x3h3 — React Server Components RCE PoC
> **Research exploit code.** This repository contains a working proof of concept
> and an intentionally vulnerable Docker lab. Use it only against systems you
> own or have explicit written permission to test.
A minimal Python PoC and Docker lab for the unauthenticated remote code
execution in React Server Components tracked as
[GHSA-xqc2-xf4c-x3h3](https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3)
(React) and
[GHSA-673q-mjm6-r5xr](https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr)
(Next.js).
## At a glance
| | |
|---|---|
| **Severity** | Critical — CVSS v4 9.5 |
| **Attack vector** | Network, unauthenticated, no user interaction |
| **React packages** | `react-server-dom-webpack`, `-parcel`, `-turbopack` |
| **Affected React** | `19.0.0–19.0.8`, `19.1.0–19.1.9`, `19.2.0–19.2.8`, `19.3.0` |
| **Fixed React** | `19.0.9`, `19.1.10`, `19.2.9`, `19.3.1` |
| **Affected Next.js** | `>= 16.0.0, <= 16.4.0` (App Router + Cache Components) |
| **Fixed Next.js** | `16.4.1` |
| **CVE** | None assigned at time of writing |
| **Prerequisite** | A `use cache` function that returns multiple typed arrays plus an attacker-controlled value |
The React advisory describes the trigger as “extremely rare cases where
responses transport multiple typed arrays and an attacker-controlled value.”
The PoC reproduces exactly that layout.
## Root cause
The Flight serializer handles multiple typed-array views over one shared
`ArrayBuffer`. On the vulnerable versions:
1. The first view causes the shared buffer to be transferred/detached.
2. A later view is serialized with its length header but **no payload**.
3. When the cached stream is read back, the decoder consumes the declared
length, over-reads into caller-supplied bytes, and resumes parsing there.
4. Forged Flight rows at that resume offset invoke a real Server Action with
attacker-chosen arguments.
The vulnerability is in th