If your website runs on Next.js or React Server Components, this is the update you cannot skip. A set of critical security flaws in React Server Components lets an attacker run their own code on your server without any login — no password, no account, nothing. The fixes have been available since 14 October 2026, yet large numbers of sites still have not updated, which is why security roundups are pushing the warning again this week. If your site is one of them, today is the day to fix it.

What actually happened

On 14 October 2026, React and Next.js shipped an emergency, out-of-band security release — the kind vendors only make when a flaw is too serious to wait for the normal schedule.

The main flaw sits in React Server Components, the technology that renders React pages on the server. In the packages react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel, versions 19.0.0 to 19.3.0, specially crafted data sent to the server is not checked safely. An attacker can use that hole to execute code on the server. The advisory (GHSA-xqc2-xf4c-x3h3) is rated critical, 9.5 out of 10.

The same release fixed more problems in Next.js itself, including:

  • A second critical remote-code-execution flaw in Next.js 16 "use cache" functions (Next.js 16.0.0 to 16.4.0)

  • A critical flaw in the Next.js Image Optimization API when handling SVG images, affecting a very wide range: Next.js 10.0.0 to 15.5.27 and 16.0.0 to 16.4.0

  • A high-severity denial-of-service flaw in apps that use Server Actions, where crafted requests can max out the server's CPU

For two of these flaws there is no workaround at all. Upgrading is the only fix.

Rows of servers in a data center
The flaw lets an attacker run code on the server itself — no login needed.

Who is affected — and who is not

You are affected if:

  • Your site uses Next.js with the App Router (versions below the fixed ones below)

  • Your React app uses Server Components or Server Functions on the server, through frameworks such as Next.js, React Router's Server Components mode, Waku or RedwoodSDK

  • You are on Next.js 13 or 14 — note that Next.js has released no fix for these old lines, so those sites must move up to a supported version

You are NOT affected if your React code runs only in the visitor's browser (a plain client-side React app with no server rendering). The flaws live in the server-side packages only.

The fixed versions — update to these

  • React server packages: 19.0.9, 19.1.10, 19.2.9 or 19.3.1 (take the patch that matches your React line)

  • Next.js 16.x: update to 16.4.1 or later (16.4.2 includes the same fixes)

  • Next.js 15.x: update to 15.5.28 or later

One warning for teams that rely on automatic scanning: in the days after the release, some of these advisories were not yet in the npm audit feed, so a scanner could report "no problems" on a site that was actually vulnerable. Check your version numbers yourself — do not trust a green scanner result alone.

How to check your site in 2 minutes

  1. Open your project and look at package.json.

  2. Find the "next" and "react" version numbers.

  3. Compare them with the fixed list above. If your Next.js is below 15.5.28 (15.x) or below 16.4.1 (16.x), you are exposed.

  4. Update, rebuild, and redeploy the site. On most hosting, this is a normal dependency update — but test the site after updating, especially pages that use caching or image optimization.

If someone else built your website, forward them this article and ask one question: "Which Next.js version are we on?" Their answer tells you everything.

Why this keeps happening to React Server Components

This is not the first emergency in this code. In December 2025, the "React2Shell" flaw (CVE-2025-55182, scored a maximum 10.0) hit the same server-component decoding, and it was serious enough to enter CISA's Known Exploited Vulnerabilities catalogue. Since then the React team has fixed several more flaws in the same area. The lesson for website owners is simple: a modern framework is not "set and forget." The same features that make Next.js fast — server rendering, caching, server actions — are also the parts attackers study hardest. If you chose Next.js after reading our WordPress vs Next.js comparison, this maintenance duty is the trade-off that comes with it: managed platforms patch themselves, a self-managed Next.js site patches when you do.

The bottom line

There were no public reports of attacks using these flaws in the first days after the October release — but that window does not stay open. Exploit code and scanning tools always follow a public critical advisory, and unpatched servers are found by address range, not by name. Whether your site is big or small makes no difference to a scanner. Check your version today, update to the fixed release, and make framework updates a monthly habit, not an emergency.

Sources

  • React security advisory GHSA-xqc2-xf4c-x3h3: unauthenticated remote code execution in React Server Components; fixed in React 19.0.9, 19.1.10, 19.2.9 and 19.3.1.

  • Next.js / Vercel: Security update for upstream vulnerabilities, 14 October 2026; fixed in Next.js 16.4.1 and 15.5.28.

  • GitHub Advisory Database: GHSA-673q-mjm6-r5xr (Next.js use cache RCE) and GHSA-2464-fhr4-w9xw / CVE-2026-96889 (Image Optimization SVG RCE).

  • The Hacker News reporting, October 2026: no public reports of exploitation at release; some advisories initially missing from the npm audit feed.

  • IT Security News roundup, 9 November 2026: critical React Server Components flaw, React team urges immediate updates.