Is your React or Next.js project affected by the React Server Components hole?

What happened#

On 14 October 2026 the React team published a critical advisory, GHSA-xqc2-xf4c-x3h3. On 10 November it was given the CVE number CVE-2026-126187, so you may see either name for the same hole. A crafted request to a server that renders React Server Components can run code on that server, without logging in. The code is in three packages: react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack.

The React team says it only affects extremely rare cases where a response carries multiple typed arrays and a value the attacker controls. They still recommend updating immediately.

Next.js doesn't install those packages from npm. It ships its own copy inside the next package, so for a Next.js app the next version is what to check. Separately, on 22 October Next.js published three advisories about its own code:

Later releases than the ones in the last column have the fixes too. For GHSA-673q-mjm6-r5xr, Next.js says there is no workaround, and to upgrade even if your app has no such use cache function.

GHSA-2464-fhr4-w9xw matters for sites deployed on Linux servers, not for a dev server on your Mac, because it only applies when Next.js runs on glibc-based Linux. Next.js gives a workaround for it: make sure the sharp that Next.js uses is 0.35.5 or later.

On 3 November Next.js released 16.4.5 and 15.5.29 with fixes for seven more advisories, all rated medium. Most are in use cache and Cache Components. The others are about HttpOnly cookies on Edge runtime routes (GHSA-f3mh-rxg3-f5g2), SVG files in image optimization (GHSA-7qx7-33qx-rqx2) and self-hosted apps that forward fetched responses (GHSA-pc58-hwjq-p385). Between them they affect Next.js 16.0.0 to 16.4.4, and those three also affect Next.js 15 up to 15.5.28. Their CVE numbers run from CVE-2026-119346 to CVE-2026-119351, plus CVE-2026-119790.

16.4.5 and 15.5.29 have the October fixes too, so it's simplest to go straight to them. The commands below do.

Who is affected, and who isn't#

• Next.js apps. Check the version of next, whatever router you use. The React hole, GHSA-673q-mjm6-r5xr and GHSA-p3m5-59mp-jv5r need the App Router. GHSA-2464-fhr4-w9xw is in the Image Optimization API, which both routers use, and applies when the site runs on glibc-based Linux.
• Apps that render React Server Components without Next.js. These use react-server-dom-webpack, -parcel or -turbopack directly, or through a framework or bundler plugin. Check those packages.
• React only in the browser. Not affected. The React team says an app whose React code doesn't use a server, or that uses no framework, bundler or plugin with React Server Components, is not affected.

A dev server that only this Mac can reach is much harder to attack, but should still be updated, and so should any site built from the project. The site you deploy is what other people can send requests to.

Check one project#

In the project folder, run the command for its package manager:

# npm
npm ls next react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack

# pnpm
pnpm why next

# yarn
yarn why next

# Any of them: the next version Node.js loads
node -p "require('next/package.json').version"

In a Next.js project, npm ls usually lists next and nothing for the react-server-dom packages. That's expected: the copy Next.js uses is inside it, in node_modules/next/dist/compiled/, so the next version is the one to compare with the table.

If npm ls prints invalid next to next, package.json asks for one version and node_modules holds another. The one in node_modules is the one that runs. Run your install to bring them in line.

Find every project on your Mac#

Old projects, clones and worktrees each have their own node_modules. This lists every installed copy of next and the three react-server-dom packages under your home folder, with its version:

find -E ~ -regex '.*/node_modules/(next|react-server-dom-(webpack|parcel|turbopack))/package\.json' 2>/dev/null |
  while read -r f; do echo "$(grep -m1 '"version"' "$f" | cut -d'"' -f4)  $f"; done

Each line is a version and a path, and the project is the folder before node_modules. Compare the version with the table. macOS may ask whether Terminal can open folders such as Documents or Desktop while it runs.

The command only finds projects that have been installed. A project with a lockfile but no node_modules gets the versions in its lockfile the next time you install it.

To check installed copies and lockfiles in one go, there's a free, open-source command-line tool from the maker of iKnowMyMac, rsc-check. It needs Node.js 18 or later:

npx @deepaks612/rsc-check ~/code

For each affected project it prints the version to move to and the command for its package manager, and names the parent package when the affected one comes in through another dependency. Leave out the folder to scan your home folder. It only reads files, changes nothing, and sends nothing: the advisory data is built in.

Update Next.js#

Use the package manager the project already uses: its lockfile tells you (package-lock.json for npm, pnpm-lock.yaml for pnpm, yarn.lock for yarn, bun.lock for Bun). For Next.js 16:

# npm
npm install next@16.4.5

# pnpm
pnpm add next@16.4.5

# yarn
yarn add next@16.4.5

# Bun
bun add next@16.4.5

For Next.js 15, use next@15.5.29 in the same commands. Next.js 10 to 14 have no fixed release on their own lines, so move the project to 15.5.29 or 16.4.5 and check that it still builds. Next.js says that upgrading also makes package managers fetch a fixed version of sharp, the image library behind GHSA-2464-fhr4-w9xw.

Update react-server-dom packages#

If the project lists react-server-dom-webpack, -parcel or -turbopack in its own package.json, update it to the fixed release on its line: 19.0.9, 19.1.10, 19.2.9 or 19.3.1. react-server-dom-webpack 19.2.9 asks for react and react-dom 19.2.9 or later, so update the three together:

npm install react-server-dom-webpack@19.2.9 react@19.2.9 react-dom@19.2.9

If the package comes in through another dependency, a framework or a plugin, update that dependency first. If it has no release with the fix yet, force the version with an override in package.json, then run your install:

// npm and Bun
"overrides": { "react-server-dom-webpack": "19.2.9" }

// pnpm
"pnpm": { "overrides": { "react-server-dom-webpack": "19.2.9" } }

// yarn
"resolutions": { "react-server-dom-webpack": "19.2.9" }

Use the package name and line the project has. Remove the override once the dependency ships the fix.

After updating#

1. 1Run npm ls next (or pnpm why next) again and check that it shows 16.4.5, or 15.5.29 on the 15 line, or later.
2. 2Stop and restart any dev server. A running server keeps the old code until it restarts.
3. 3Build the project and deploy it. A deployed site runs the version it was built with, until you deploy again.

To see which Node.js servers on your Mac accept connections from other machines, run lsof -nP -iTCP -sTCP:LISTEN | grep node. 127.0.0.1 or [::1] means this Mac only, and * means other machines on your network too. The Next.js CLI docs say next dev listens on 0.0.0.0 by default. next dev -H 127.0.0.1 keeps it to this Mac.

Package Watch in iKnowMyMac#