# Critical React Server Components Flaw Enables Unauthenticated Remote Code Execution (GHSA-xqc2-xf4c-x3h3)

> A critical flaw in the React Server Components packages react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack lets an unauthenticated remote attacker achieve code execution on the server. It requires an unusual response pattern in which several typed arrays and an attacker-controlled value are serialized together. Fixed in 19.0.9, 19.1.10, 19.2.9 and 19.3.1; no CVE has been assigned and no in-the-wild exploitation has been reported.

- **Published:** 2026-11-09T02:24:57Z
- **Last reviewed:** 2026-11-09T02:24:57Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5515
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5515.png
- **ID:** TL-2026-5515
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (3 shown free below)
- **CVEs:** CVE-2025-55182

## Description

GHSA-xqc2-xf4c-x3h3 was published by the React team on 2026-10-14 with a CVSS v4.0 base score of 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N). The advisory states that crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution, and that this only affects rare cases where responses carry multiple typed arrays and an attacker-controlled value. The finder is credited as 'evolutionstorm'. No CVE identifier and no CWE were listed in the advisory.

Per the Mend.io entry WS-2026-0170 (which maps the issue to CWE-502 and a CVSS v3 score of 9.0), the React Server Components response writer emits typed arrays as views over their entire underlying ArrayBuffer and writes large chunks without copying. When one response carries several typed arrays that share a buffer, together with an attacker-controlled value, the transported stream can be corrupted, which can lead to remote code execution. The affected component is the Flight transport used by the three bundler-specific server-dom packages. The vendor release notes describe the fix only as 'Improve transport protocol'.

Affected versions in all three packages are 19.0.0-19.0.8, 19.1.0-19.1.9, 19.2.0-19.2.8 and 19.3.0 (npm ranges in Mend begin at 19.0.1 for the 19.0 line). Patched releases 19.0.9, 19.1.10, 19.2.9 and 19.3.1 shipped on 2026-10-14 (React PRs #37842-#37845). Applications are not affected if their React code does not run on a server, or if they use no framework, bundler or bundler plugin that supports React Server Components. No workaround is given; the only remediation is to upgrade.

No public proof-of-concept, active exploitation, attribution or network IOCs have been reported in the cited sources. The older React2Shell flaw (CVE-2025-55182, GHSA-fv66-9v8q-g76r) is a separate unauthenticated deserialization RCE in the same package family and its exploitation must not be taken as evidence of exploitation of this issue. Because the exploit precondition (a response pattern with multiple typed arrays and attacker-influenced data) is rare and the public description is brief, real-world prevalence is not established.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1005 Data from Local System
- T1565.001 Data Manipulation: Stored Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Node.js / Next.js Server Process Spawning Shell or Discovery Commands (Post-Exploitation of RSC RCE, GHSA-xqc2-xf4c-x3h3)** (`TL-2026-5515-SPL-002`)

Detects a Node.js, Next.js server or Bun process creating a POSIX shell (T1059.004) or host/user discovery utilities such as whoami, id, uname, hostname, ifconfig and printenv (T1033, T1082). A web-facing React Server Components host that achieves server-side JavaScript execution (T1059.007) through GHSA-xqc2-xf4c-x3h3 will usually need a shell and quick situational awareness commands. Production RSC servers rarely spawn these, so this is high fidelity once baselined.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.004, T1059.007, T1033, T1082
- **Data sources:** splunk index=linux sourcetype=Syslog:Linux-Sysmon/Operational, sysmon_for_linux EventCode=1
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=linux sourcetype="Syslog:Linux-Sysmon/Operational" EventCode=1 earliest=-24h
| where match(ParentImage,"(?i)/(node|nodejs|next-server|bun)$") AND match(Image,"(?i)/(sh|bash|dash|zsh|ash|busybox|whoami|id|uname|hostname|ifconfig|printenv|env)$")
| eval stage=if(match(Image,"(?i)/(whoami|id|uname|hostname|ifconfig|printenv|env)$"),"discovery_T1033_T1082","unix_shell_T1059_004")
| table _time host User stage ParentImage ParentCommandLine Image CommandLine
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node", "nodejs", "next-server", "bun")
| where FileName in~ ("sh", "bash", "dash", "zsh", "ash", "busybox", "whoami", "id", "uname", "hostname", "ifconfig", "printenv", "env")
| extend Stage = iff(FileName in~ ("whoami", "id", "uname", "hostname", "ifconfig", "printenv", "env"), "discovery", "unix_shell")
| project Timestamp, DeviceName, AccountName, Stage, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: Node.js Server Process Spawning a Shell or Discovery Command
id: 9e2f4a85-3d9a-4b4c-8f68-a4d5b3e7a404
status: experimental
description: |
    Detects a Node.js, Next.js or Bun server process launching a POSIX shell or host/user discovery utilities, the primary post-exploitation signal of server-side JavaScript RCE such as GHSA-xqc2-xf4c-x3h3.
references:
    - https://github.com/facebook/react/security/advisories/GHSA-xqc2-xf4c-x3h3
    - https://www.mend.io/vulnerability-database/WS-2026-0170/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-09
tags:
    - attack.execution
    - attack.t1059.004
    - attack.t1059.007
    - attack.discovery
    - attack.t1033
    - attack.t1082
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith:
            - '/node'
            - '/nodejs'
            - '/next-server'
            - '/bun'
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/zsh'
            - '/ash'
            - '/busybox'
            - '/whoami'
            - '/id'
            - '/uname'
            - '/hostname'
            - '/ifconfig'
            - '/printenv'
    condition: selection
falsepositives:
    - Applications that intentionally shell out (image processing, git operations, build scripts)
    - Developer tooling such as npm lifecycle scripts run under node
level: high

```

**Known false positives:**

- Applications that deliberately call child_process.exec or spawn a shell
- npm lifecycle scripts and build tools running under node in CI

**Tuning notes:** Allowlist known ParentCommandLine / CommandLine pairs per application and restrict to production web tiers. Exclude CI build hosts. For containers, scope by container name so only RSC-serving workloads alert. If discovery binaries are noisy (health checks calling env or id), drop them from the list and keep shells only.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- React Server Components Oversized POST Body Versus Host Baseline (GHSA-xqc2-xf4c-x3h3) (locked: unlock with TL Creds)
- Node.js Inline JavaScript Execution Using child_process (RSC RCE Payload Staging, GHSA-xqc2-xf4c-x3h3) (locked: unlock with TL Creds)
- Node.js Runtime Writing to Server Bundle or react-server-dom Files (Stored Data Manipulation, GHSA-xqc2-xf4c-x3h3) (locked: unlock with TL Creds)
- Vulnerable react-server-dom Package Version Installed (GHSA-xqc2-xf4c-x3h3) (locked: unlock with TL Creds)
- Node.js Process Downloading and Executing Second-Stage Payload (GHSA-xqc2-xf4c-x3h3) (locked: unlock with TL Creds)
- Reverse Shell Command Lines Spawned on Web Application Host (C2 After RSC RCE, GHSA-xqc2-xf4c-x3h3) (locked: unlock with TL Creds)
- React Server Components Exploit Attempt - Repeated RSC POST Server Errors (GHSA-xqc2-xf4c-x3h3, TL-2026-5515) (locked: unlock with TL Creds)
- Secrets and Credential File Access From Node.js Process Chain (T1005 / T1552 After RSC RCE, GHSA-xqc2-xf4c-x3h3) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 12)

Defanged, TLP:CLEAR.

- File hash: `611d9217df39cf7b8ac91b2e41fd00555923e904`
- File hash: `249ac87b0dadea4ba024d1393e5cb60cf1186080`
- File hash: `3d06b4005ac0cf9dec37267f26174adfe6d83611`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [GHSA-xqc2-xf4c-x3h3: Unauthenticated Remote Code Execution in React Server Components](https://github.com/facebook/react/security/advisories/GHSA-xqc2-xf4c-x3h3)
- [Critical React Server Components Flaw Lets Hackers Execute Code Remotely Without Authentication](https://cybersecuritynews.com/react-server-components-vulnerability-patch/)
- [Mend.io Vulnerability Database WS-2026-0170](https://www.mend.io/vulnerability-database/WS-2026-0170/)
- [React releases (19.0.9, 19.1.10, 19.2.9, 19.3.1)](https://github.com/facebook/react/releases)
- [React PR #37842 - Improve transport protocol (19.0.x backport)](https://github.com/facebook/react/pull/37842)
- [React PR #37843 - Improve transport protocol (19.1.x backport)](https://github.com/facebook/react/pull/37843)
- [React PR #37844 - Improve transport protocol (19.2.x backport)](https://github.com/facebook/react/pull/37844)
- [React PR #37845 - Improve transport protocol (19.3.x)](https://github.com/facebook/react/pull/37845)
- [GHSA-fv66-9v8q-g76r / CVE-2025-55182 (React2Shell, separate earlier issue)](https://osv.dev/vulnerability/GHSA-fv66-9v8q-g76r)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5515