CVE-2026-126187

The react-server-dom-webpack , react-server-dom-parcel , and react-server-dom-turbopack packages in React are vulnerable to unauthenticated remote code execution (RCE). The root cause involves the processing of crafted payloads in extremely rare cases where responses transport multiple typed arra...