[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVpszbvpEUjahUZurV_flONKuerQuW5hpqAax942RivI":3},{"article":4,"iocs":44,"watch_terms":52,"solutions":53,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"c9ccee51-e928-4b50-9161-c5d00e0e1ce7","CVE-2026-126187: React Server Components Flaw Lets Attackers Execute Code Through Smuggled Flight Rows","cve-2026-126187-react-server-components-flaw-lets-attackers-execute-code-through-326e47","React shipped fixes on November 10, 2026 for a CVSS 9.5 unauthenticated RCE in React Server Components' Flight protocol. Read how a silent serialization bug turns typed arrays into code execution, who is exposed, and how to find affected installs in CI and on developer machines.","A critical vulnerability (CVSS 9.5) in React Server Components' Flight protocol, CVE-2026-126187, allows unauthenticated remote code execution. The flaw, fixed on November 10, 2026, stems from a serialization bug where typed arrays can be turned into code execution under specific conditions involving multiple typed arrays and attacker-controlled data. Affected versions range from 19.0.0 to 19.3.8, with fixes available in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.","React Server Components flaw allows unauthenticated RCE via Flight protocol serialization bug.","https:\u002F\u002Fwww.stepsecurity.io\u002Fblog\u002Fcve-2026-126187-react-flight-rce","https:\u002F\u002Fcdn.prod.website-files.com\u002F673b71f0790aabf30bd30bf8\u002F6af5d2315be9d7c33e41b26d_6af5d212d0e406b80bc6a92e_cve-2026-126187-cover-v2.png","2026-11-12T15:00:22+00:00","2026-11-12T15:00:33.685825+00:00",9,[17,20,22,24],{"name":18,"type":19},"React Server Components","product",{"name":21,"type":19},"react-server-dom-webpack",{"name":23,"type":19},"react-server-dom-parcel",{"name":25,"type":19},"react-server-dom-turbopack","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49],{"type":46,"value":47,"context":48},"cve","CVE-2026-126187","Vulnerability identifier for React Server Components RCE flaw",{"type":46,"value":50,"context":51},"CVE-2025-55182","Previously fixed Flight protocol flaw",[18,21,23],{"controls":54,"vendors":136},[55,84,109],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":85,"name":86,"problem":87,"products":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",[89,93,101],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":85,"product_name":90,"url":91,"description":92},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":110,"name":111,"problem":112,"products":113},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[114,120,128],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":115,"product_name":116,"url":118,"description":119},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":147},"critical-react-server-components-rce-flaw-demands-immediate-patching","Critical React Server Components RCE Flaw Demands Immediate Patching","A serialization vulnerability in React Server Components' Flight protocol allows unauthenticated attackers to achieve remote code execution by smuggling malicious data through typed arrays, earning a near-maximum CVSS score of 9.5. Any application running React versions 19.0.0 through 19.3.8 that exposes Server Components to untrusted input is at risk of full server compromise without requiring any authentication. The flaw highlights how deeply embedded framework internals — such as serialization protocols — can carry catastrophic risk when attacker-controlled data reaches deserialization paths. Because fixes were released across multiple patch branches simultaneously, organizations must audit which React version they are pinned to and apply the correct backport. Delayed patching of critical framework vulnerabilities directly translates to open attack surface against production infrastructure.",[142,143,144,145,146],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A08:2021 Software and Data Integrity Failures","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":148,"NIST SP 800-53 SI-2: Flaw Remediation":149,"OWASP A08:2021 Software and Data Integrity Failures":150,"CIS Control 7: Continuous Vulnerability Management (v8)":151,"CIS Control 2: Inventory and Control of Software Assets (v8)":152},"NIS2 Article 21(2)(e) requires security in acquisition, development, and maintenance including vulnerability handling, meaning operators must have processes to identify and patch critical framework vulnerabilities like this React RCE.","SI-2 mandates identifying, reporting, and correcting information system flaws in a timely manner, which directly applies to deploying the available React patches before unauthenticated RCE can be exploited.","This OWASP category covers insecure deserialization and integrity failures in software components, which is precisely the class of vulnerability — attacker-controlled data reaching a serialization path — exploited through the Flight protocol flaw.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; a formal process would have flagged the affected React versions and driven patching before attackers could exploit the serialization flaw.","CIS Control 2 requires maintaining an accurate inventory of all software in use; knowing which applications ran vulnerable React 19.x versions is a prerequisite for rapid, targeted patch deployment."]