CVE-2026-126187: React Server Components Flaw Lets Attackers Execute Code Through Smuggled Flight Rows

A serialization vulnerability in React Server Components' Flight protocol allows unauthenticated attackers to achieve remote code execution by smuggling malicious data through typed arrays, earning a near-maximum CVSS score of 9.5. Any application running React versions 19.0.0 through 19.3.8 that exposes Server Components to untrusted input is at risk of full server compromise without requiring any authentication. The flaw highlights how deeply embedded framework internals — such as serialization protocols — can carry catastrophic risk when attacker-controlled data reaches deserialization paths. Because fixes were released across multiple patch branches simultaneously, organizations must audit which React version they are pinned to and apply the correct backport. Delayed patching of critical framework vulnerabilities directly translates to open attack surface against production infrastructure.