Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.
Affected packages
Vulnerable: >= 19.0.0, < 19.0.9
Patched in 19.0.9
Vulnerable: >= 19.1.0, < 19.1.10
Patched in 19.1.10
Vulnerable: >= 19.2.0, < 19.2.9
Patched in 19.2.9
Vulnerable: >= 19.3.0, < 19.3.1
Patched in 19.3.1
Vulnerable: >= 19.0.0, < 19.0.9
Patched in 19.0.9
Vulnerable: >= 19.1.0, < 19.1.10
Patched in 19.1.10
Vulnerable: >= 19.2.0, < 19.2.9
Patched in 19.2.9
Vulnerable: >= 19.3.0, < 19.3.1
Patched in 19.3.1
Vulnerable: >= 19.0.0, < 19.0.9
Patched in 19.0.9
Vulnerable: >= 19.1.0, < 19.1.10
Patched in 19.1.10
Vulnerable: >= 19.2.0, < 19.2.9
Patched in 19.2.9
Vulnerable: >= 19.3.0, < 19.3.1
Patched in 19.3.1
Details
Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value.
Updating immediately is recommended.
The vulnerability exists in versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8 and 19.3.0 of:
Fixes were back ported to versions 19.0.09, 19.1.10, 19.2.9, and 19.3.1.
If applications are using any of the above packages please upgrade to any of the fixed versions immediately.
If an app’s React code does not use a server, the app is not affected by this vulnerability. If an app does not use a framework, bundler, or bundler plugin that supports React Server Components, the app is not affected by this vulnerability.
More npm advisories
Talk to us about this
Find out whether this dependency (or others like it) is actually reachable in your codebase.
Get help patching, or building dependency-scanning into your pipeline going forward.
A secure code review or supply chain review finds this before an advisory does.