Back to Zero Wire

React Server Components typed-array RCEPatch

A flaw in how React Server Components serialize several typed arrays in one payload can let an unauthenticated attacker run code on the server.

Last reviewed

Updates

  1. GitHub added the Next.js advisory to its Advisory Database, so npm audit now flags affected next versions.

  2. Hash Security published an analysis and a lab proof of concept.

  3. React and Next.js published advisories and fixed releases.

Overview

Details

React Server Components send data between server and client in a format called Flight.

According to Hash Security's analysis, the trigger is several large typed arrays that share one underlying buffer. The writer then frames the stream incorrectly, and the reader can treat attacker-controlled bytes as protocol rows that call a Server Action with arguments the attacker chooses. Command execution needs a Server Action that does something dangerous with those arguments. React's fix changes how such typed arrays are written.

In Next.js, the path is an App Router app with Cache Components and a use cache function that returns several typed arrays. Versions 16.0.0 to 16.4.0 are affected. Next.js 15 is not listed in the advisory, but 15.5.28 includes React's transport protocol fix and a separate critical image optimization fix (CVE-2026-96889).

React describes the affected cases as extremely rare, and Vercel says there is no workaround. Neither advisory has a CVE ID. As of November 8, the React advisory was not in the GitHub Advisory Database, so npm audit does not flag the react-server-dom packages.

Risk

An unauthenticated attacker can run code in rare apps whose RSC payloads mix several typed arrays with attacker input. A public proof of concept exists; no exploitation reported as of November 8.

Affected deployments

Next.js 16.0.0–16.4.0 apps that use the App Router with Cache Components. Also other RSC frameworks or bundler setups with react-server-dom-webpack, -turbopack or -parcel 19.x before 19.0.9, 19.1.10, 19.2.9 or 19.3.1. Next.js 15.5 is not listed in the advisory, but 15.5.28 includes React's transport fix, so update 15.5 apps too. Apps that don't render React on a server are not affected.

Recommended action

Update Next.js to 16.4.1 or later (15.5.28 on 15.x) or react-server-dom-* to a fixed 19.x release, then check the deployed version. Updating React alone does not fix Next.js.

  1. Find apps that use React Server Components. Check lockfiles for next and the react-server-dom-* packages, including monorepo workspaces and container images.

  2. Update Next.js 16 apps to 16.4.1 or later, and Next.js 15.5 apps to 15.5.28 or later. Next.js ships its own compiled copy of the RSC packages, so the fix only arrives through the next package.

  3. For other RSC frameworks or custom bundler setups, update react-server-dom-* to 19.0.9, 19.1.10, 19.2.9 or 19.3.1, or to the framework release that includes them.

  4. Rebuild and redeploy, then check the version in the deployed image or artifact, for example node_modules/next/package.json. A fixed lockfile alone does not show that the fix is running.

Use this prompt with an agent that can inspect your infrastructure.

Assess whether the applications available to you are affected by the React Server Components typed-array remote code execution flaw (React GHSA-xqc2-xf4c-x3h3, Next.js GHSA-673q-mjm6-r5xr). Perform a read-only assessment within your authorized access. Do not send crafted payloads, run proof-of-concept code, change dependencies or redeploy.

1. Verify the React advisory at https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3 and the Next.js advisory at https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr. Establish affected and fixed versions. Cite sources and retrieval dates.

2. Inventory accessible repositories, monorepo workspaces and container images. From lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock), record the resolved versions of next, react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel. Next.js bundles its own copy of the RSC packages, so judge Next.js apps by the next version (fixed in 16.4.1 and 15.5.28), not by a separate react-server-dom entry.

3. For Next.js 16 apps, record whether they use the App Router, whether Cache Components is enabled (cacheComponents in next.config) and whether any use cache function returns typed arrays such as Uint8Array or Buffer. Vercel advises upgrading regardless, so treat this as prioritization, not a reason to skip the update.

4. Where deployment metadata is available, check that the running build matches the lockfile you assessed.

Return a concise summary and a table: app | next version | react-server-dom package/version | App Router / Cache Components | typed arrays in use cache | assessment (affected, fixed, not applicable or unknown) | evidence | next action. Separate a fixed lockfile from a deployed fix. List apps you could not assess and the access needed.

Find more information and resources at https://radar.cloudflare.com/security/zero-wire/rsc-typed-array-rce

Evidence and sources

Vendor advisories

Both are rated Critical, CVSS 4.0 9.5.

Fixes

Technical analysis

A third-party walkthrough and lab proof of concept, not verified by Cloudflare.

CISA KEV

Not in the KEV catalog retrieved on November 8 (version 2026.11.06). KEV only lists flaws with a CVE ID, so its absence says nothing about exploitation here.