Last reviewed
PatchReact Server Components typed-array RCE
A flaw in how React Server Components serialize several typed arrays in one payload can let an unauthenticated attacker run code on the server.
Risk
An unauthenticated attacker can run code in rare apps whose RSC payloads mix several typed arrays with attacker input. A public proof of concept exists; no exploitation reported as of November 8.
Recommended action
Update Next.js to 16.4.1 or later (15.5.28 on 15.x) or react-server-dom-* to a fixed 19.x release, then check the deployed version. Updating React alone does not fix Next.js.