Critical Flaw in React Server Components Enables Unauthenticated Remote Code Execution
The React team published security advisory GHSA-xqc2-xf4c-x3h3 on 14 October, detailing a critical vulnerability capable of leading to remote code execution in applications built with React Server Components. The advisory rates the impact on data privacy, integrity, and availability as high and does not carry a CVE identifier, so tracking occurs solely through the GitHub Security Advisory code.
Exploitation depends on specially crafted payloads sent to frameworks that support React Server Components. The risky condition involves a server response that carries multiple typed arrays alongside attacker-controlled data. Typed arrays are structures that store numeric data in defined formats, yet neither the advisory nor published coverage details the exact path from these arrays to code execution.
What makes the flaw severe is what it does not require. No account on the application, no privileges, and no interaction from the end user are needed. A remote attacker can achieve code execution on the server simply by sending the correct request, removing the barriers that normally restrict such attacks to already-authenticated users.
The affected packages are react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, which bridge React with each of these server-side bundlers. Vulnerable versions span 19.0.0 to 19.0.8, 19.1.0 to 19.1.9, 19.2.0 to 19.2.8, and 19.3.0. The fixed releases are 19.0.9, 19.1.10, 19.2.9, and 19.3.1.
The React team recommends updating the packages immediately and verifying the installed version against the official advisory ranges rather than relying on older remediation guides. No alternative mitigations have been published for organizations unable to update right away.
Not every application using React is exposed. Projects that do not execute React code on the server, or that do not use a framework, bundler, or plugin supporting React Server Components, remain unaffected. The practical check is to inspect which server-dom packages are installed and at what version, because their presence defines the risk rather than the use of React itself.
The October advisory is not the React2Shell issue registered as CVE-2025-55182, and attacks against that earlier flaw do not demonstrate exploitation of the current vulnerability. As of publication, no public reports of active exploitation of this case have surfaced. The React team also associated similar vulnerabilities in Next.js, including a Cache Components problem involving multiple typed arrays, indicating a wider class of errors beyond a single package.
Related articles
Top 5 Cybersecurity Events of the Week: Barracuda Root Exploits, cPGuard Supply-Chain Attack, APT Flaw, Xen Escape Bugs, and OpenSSH Authentication Bypass
This week’s Jet CSIRT roundup highlights five critical security issues affecting widely deployed infrastructure. Two high-severity vulnerabilities in Barracuda Email Security Gateway and other appliances allow unauthenticated attackers to obtain root access via authorization bypass and command injection. A supply-chain compromise of cPGuard versions 5.88.12–5.88.19 enabled theft of password hashes, database files, and SSH keys from at least 32 customer servers before the malicious update was removed. A flaw in the APT package manager (CVE-2026-109518) lets network attackers substitute malicious packages that execute with root privileges on Debian and Ubuntu systems. Two Xen hypervisor bugs (CVE-2026-102703 and CVE-2026-102704) permit a compromised guest VM to read and write memory belonging to dom0 and other guests. Finally, an OpenSSH authentication bypass on musl-based Alpine Linux distributions allows passwordless login to key-only accounts when long password hashes trigger a crypt() return value of “*”.
CISA and FBI Warn of Global Cyber Attacks on Industrial Refrigeration and Cold Chain Controllers
CISA, the FBI, and multiple U.S. agencies issued a joint advisory on November 5 detailing malicious cyber activity targeting industrial refrigeration systems and cold chain monitoring equipment worldwide. Attackers are exploiting unpatched or internet-exposed temperature controllers in supermarkets and cold storage facilities through authentication bypass, arbitrary code injection, and weak configurations. Once inside the control panels, threat actors force units into continuous heating and defrost cycles, the opposite of their intended function, while also causing denial of visibility that prevents operators from seeing real equipment status. The advisory highlights risks including reduced system lifespan, fire hazards, stock loss, and potential consumer harm from spoiled products stored outside safe temperature ranges. Sectors most affected include public health, chemical manufacturing, food and agriculture, and refrigerated transportation. Recommended mitigations focus on network segmentation, removal of remote access from the public internet, strong authentication, firmware updates, and regular offline backups.
Plex Media Server Vulnerabilities Exploited in Wild via Plex2Shell Chain
Plex has disclosed active exploitation of four vulnerabilities in Plex Media Server versions 1.43.2 and earlier. The flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, allow unauthenticated remote code execution when chained together. Attackers are leveraging server-side request forgery and token-handling weaknesses to write arbitrary files on exposed servers. Proof-of-concept code named Plex2Shell was published on 16 October, after which CISA added the issues to its Known Exploited Vulnerabilities catalog. Compromised systems have been observed deploying cryptocurrency miners and proxy relays. The software is widely used both as a standalone media server and as an add-on for QNAP and other NAS devices, increasing the potential attack surface.
Google Issues Chrome Security Update Fixing Nine Vulnerabilities Including Zero-Day Exploit
Google has released a security update for its Chrome browser that addresses nine vulnerabilities, one of which is a zero-day flaw already being exploited in the wild. The update covers Windows, macOS, and Linux platforms with versions 157.0.8103.51 and 157.0.8103.50. Seven of the issues are rated High severity, while two are rated Medium. The zero-day vulnerability CVE-2026-125350 is a Use After Free flaw in XML processing that was reported on November 6. Additional fixes address similar Use After Free issues, type confusion in the V8 engine, out-of-bounds writes in GPU, and problems in WebGL, FileSystem, and Compositing components.