Skip to navigation

Threat reportVulnerabilityTL-2026-5515

Critical React Server Components Flaw Enables Unauthenticated Remote Code Execution (GHSA-xqc2-xf4c-x3h3)

criticalPATCHED

A critical flaw in the React Server Components packages react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack lets an unauthenticated remote attacker achieve code execution on the server. It requires an unusual response pattern in which several typed arrays and an attacker-controlled value are serialized together. First disclosed .

Key facts for React Server Components RCE

IdentifiersTL-2026-5515, CVE-2025-55182
Also known asGHSA-xqc2-xf4c-x3h3, WS-2026-0170
SeverityCRITICAL
CVSS9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N)
First disclosed
Exploitation statusNo exploitation observed (theoretical); Listed in CISA KEV: CVE-2025-55182 (added )
EPSSCVE-2025-55182: 99.8% (99.9th percentile)
Affected productsMeta / React react-server-dom-webpack; Meta / React react-server-dom-parcel; Meta / React react-server-dom-turbopack
Weaknesses (CWE)CWE-502
MITRE ATT&CK techniquesT1005 Data from Local System, T1059 Command and Scripting Interpreter, T1059.007 Command and Scripting Interpreter: JavaScript, T1190 Exploit Public-Facing Application, T1565.001 Data Manipulation: Stored Data Manipulation
MotivationUNKNOWN
Target sectorstechnology, finance, retail, government administration, health
Target regionsGlobal
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for React Server Components RCE

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5515 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Node.js / Next.js Server Process Spawning Shell or Discovery Commands (Post-Exploitation of RSC RCE, GHSA-xqc2-xf4c-x3h3)

Detects a Node.js, Next.js server or Bun process creating a POSIX shell (T1059.004) or host/user discovery utilities such as whoami, id, uname, hostname, ifconfig and printenv (T1033, T1082). A web-facing React Server Components host that achieves server-side JavaScript execution (T1059.007) through GHSA-xqc2-xf4c-x3h3 will usually need a shell and quick situational awareness commands. Production RSC servers rarely spawn these, so this is high fidelity once baselined.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1059.004, T1059.007, T1033, T1082
  • Data sources: splunk index=linux sourcetype=Syslog:Linux-Sysmon/Operational, sysmon_for_linux EventCode=1
  • Severity: high
  • Confidence: medium

Splunk SPL

index=linux sourcetype="Syslog:Linux-Sysmon/Operational" EventCode=1 earliest=-24h
| where match(ParentImage,"(?i)/(node|nodejs|next-server|bun)$") AND match(Image,"(?i)/(sh|bash|dash|zsh|ash|busybox|whoami|id|uname|hostname|ifconfig|printenv|env)$")
| eval stage=if(match(Image,"(?i)/(whoami|id|uname|hostname|ifconfig|printenv|env)$"),"discovery_T1033_T1082","unix_shell_T1059_004")
| table _time host User stage ParentImage ParentCommandLine Image CommandLine

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node", "nodejs", "next-server", "bun")
| where FileName in~ ("sh", "bash", "dash", "zsh", "ash", "busybox", "whoami", "id", "uname", "hostname", "ifconfig", "printenv", "env")
| extend Stage = iff(FileName in~ ("whoami", "id", "uname", "hostname", "ifconfig", "printenv", "env"), "discovery", "unix_shell")
| project Timestamp, DeviceName, AccountName, Stage, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

Sigma

title: Node.js Server Process Spawning a Shell or Discovery Command
id: 9e2f4a85-3d9a-4b4c-8f68-a4d5b3e7a404
status: experimental
description: |
    Detects a Node.js, Next.js or Bun server process launching a POSIX shell or host/user discovery utilities, the primary post-exploitation signal of server-side JavaScript RCE such as GHSA-xqc2-xf4c-x3h3.
references:
    - https://github.com/facebook/react/security/advisories/GHSA-xqc2-xf4c-x3h3
    - https://www.mend.io/vulnerability-database/WS-2026-0170/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-09
tags:
    - attack.execution
    - attack.t1059.004
    - attack.t1059.007
    - attack.discovery
    - attack.t1033
    - attack.t1082
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith:
            - '/node'
            - '/nodejs'
            - '/next-server'
            - '/bun'
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/zsh'
            - '/ash'
            - '/busybox'
            - '/whoami'
            - '/id'
            - '/uname'
            - '/hostname'
            - '/ifconfig'
            - '/printenv'
    condition: selection
falsepositives:
    - Applications that intentionally shell out (image processing, git operations, build scripts)
    - Developer tooling such as npm lifecycle scripts run under node
level: high

Known false positives:

  • Applications that deliberately call child_process.exec or spawn a shell
  • npm lifecycle scripts and build tools running under node in CI

Tuning notes: Allowlist known ParentCommandLine / CommandLine pairs per application and restrict to production web tiers. Exclude CI build hosts. For containers, scope by container name so only RSC-serving workloads alert. If discovery binaries are noisy (health checks calling env or id), drop them from the list and keep shells only.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • React Server Components Oversized POST Body Versus Host Baseline (GHSA-xqc2-xf4c-x3h3) · unlock with TL Creds
  • Node.js Inline JavaScript Execution Using child_process (RSC RCE Payload Staging, GHSA-xqc2-xf4c-x3h3) · unlock with TL Creds
  • Node.js Runtime Writing to Server Bundle or react-server-dom Files (Stored Data Manipulation, GHSA-xqc2-xf4c-x3h3) · unlock with TL Creds
  • Vulnerable react-server-dom Package Version Installed (GHSA-xqc2-xf4c-x3h3) · unlock with TL Creds
  • Node.js Process Downloading and Executing Second-Stage Payload (GHSA-xqc2-xf4c-x3h3) · unlock with TL Creds
  • Reverse Shell Command Lines Spawned on Web Application Host (C2 After RSC RCE, GHSA-xqc2-xf4c-x3h3) · unlock with TL Creds
  • React Server Components Exploit Attempt - Repeated RSC POST Server Errors (GHSA-xqc2-xf4c-x3h3, TL-2026-5515) · unlock with TL Creds
  • Secrets and Credential File Access From Node.js Process Chain (T1005 / T1552 After RSC RCE, GHSA-xqc2-xf4c-x3h3) · unlock with TL Creds

Indicators of compromise for React Server Components RCE

As of 2026-11-09, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5515.

Sample indicators (3 of 12)

  • File hash: 611d9217df39cf7b8ac91b2e41fd00555923e904
  • File hash: 249ac87b0dadea4ba024d1393e5cb60cf1186080
  • File hash: 3d06b4005ac0cf9dec37267f26174adfe6d83611

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

12 indicators of compromise · unlock with TL Creds. Compare plans

How React Server Components RCE works

Fixed in 19.0.9, 19.1.10, 19.2.9 and 19.3.1; no CVE has been assigned and no in-the-wild exploitation has been reported.

GHSA-xqc2-xf4c-x3h3 was published by the React team on 2026-10-14 with a CVSS v4.0 base score of 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N). The advisory states that crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution, and that this only affects rare cases where responses carry multiple typed arrays and an attacker-controlled value. The finder is credited as 'evolutionstorm'. No CVE identifier and no CWE were listed in the advisory.

Per the Mend.io entry WS-2026-0170 (which maps the issue to CWE-502 and a CVSS v3 score of 9.0), the React Server Components response writer emits typed arrays as views over their entire underlying ArrayBuffer and writes large chunks without copying. When one response carries several typed arrays that share a buffer, together with an attacker-controlled value, the transported stream can be corrupted, which can lead to remote code execution. The affected component is the Flight transport used by the three bundler-specific server-dom packages. The vendor release notes describe the fix only as 'Improve transport protocol'.

Affected versions in all three packages are 19.0.0-19.0.8, 19.1.0-19.1.9, 19.2.0-19.2.8 and 19.3.0 (npm ranges in Mend begin at 19.0.1 for the 19.0 line). Patched releases 19.0.9, 19.1.10, 19.2.9 and 19.3.1 shipped on 2026-10-14 (React PRs #37842-#37845). Applications are not affected if their React code does not run on a server, or if they use no framework, bundler or bundler plugin that supports React Server Components. No workaround is given; the only remediation is to upgrade.

No public proof-of-concept, active exploitation, attribution or network IOCs have been reported in the cited sources. The older React2Shell flaw (CVE-2025-55182, GHSA-fv66-9v8q-g76r) is a separate unauthenticated deserialization RCE in the same package family and its exploitation must not be taken as evidence of exploitation of this issue. Because the exploit precondition (a response pattern with multiple typed arrays and attacker-influenced data) is rare and the public description is brief, real-world prevalence is not established.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter; T1059.007 Command and Scripting Interpreter: JavaScript

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

Remediation for React Server Components RCE

Patches

  • react-server-dom-webpack/parcel/turbopack 19.0.9
  • react-server-dom-webpack/parcel/turbopack 19.1.10
  • react-server-dom-webpack/parcel/turbopack 19.2.9
  • react-server-dom-webpack/parcel/turbopack 19.3.1

Immediate actions

  • Upgrade react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack to 19.0.9, 19.1.10, 19.2.9 or 19.3.1 according to your release line
  • Inventory installed server-dom package versions (including transitive dependencies in framework lockfiles) against the affected ranges 19.0.0-19.0.8, 19.1.0-19.1.9, 19.2.0-19.2.8 and 19.3.0

Workarounds

  • No vendor workaround published; applications without server-side React code, or without a framework, bundler or plugin supporting React Server Components, are not affected

Longer-term hardening

  • Track framework releases (e.g. Next.js and other RSC-capable frameworks/bundler plugins) that bundle the server-dom packages and rebuild and redeploy after upgrades
  • Monitor GitHub Security Advisories for the react repository and enable dependency scanning (SCA) on npm lockfiles

Affected and fixed versions

  • Meta / React — react-server-dom-webpack
    Vulnerable versions: 19.0.0-19.0.8; 19.1.0-19.1.9; 19.2.0-19.2.8; 19.3.0
    Fixed in: 19.0.9; 19.1.10; 19.2.9; 19.3.1
  • Meta / React — react-server-dom-parcel
    Vulnerable versions: 19.0.0-19.0.8; 19.1.0-19.1.9; 19.2.0-19.2.8; 19.3.0
    Fixed in: 19.0.9; 19.1.10; 19.2.9; 19.3.1
  • Meta / React — react-server-dom-turbopack
    Vulnerable versions: 19.0.0-19.0.8; 19.1.0-19.1.9; 19.2.0-19.2.8; 19.3.0
    Fixed in: 19.0.9; 19.1.10; 19.2.9; 19.3.1

Timeline of React Server Components RCE

  • Separate, earlier React Server Components unauthenticated RCE (CVE-2025-55182, React2Shell) publicly disclosed; not the same flaw as GHSA-xqc2-xf4c-x3h3
  • Mend.io records WS-2026-0170 for the advisory, mapping it to CWE-502 and CVSS v3 9.0
  • React releases 19.0.9, 19.1.10, 19.2.9 and 19.3.1 of the three server-dom packages ('Improve transport protocol', PRs #37842-#37845)
  • React team publishes GHSA-xqc2-xf4c-x3h3 (CVSS v4.0 9.5), crediting 'evolutionstorm' as finder; no CVE assigned
  • Mend.io updates WS-2026-0170 entry
  • Cyber Security News reports the flaw; the article states no active exploitation is claimed in the advisory

Sources cited for React Server Components RCE

Other reports on CVE-2025-55182

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats