limbo.watch
Menu

Left limbo: reviewed by GitHub after 27 days

GHSA-xqc2-xf4c-x3h3

react-server-dom-parcel on npm · published in react/react

Read the advisory on GitHub ↗

Facts

Severity
Critical · CVSS score 9.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
Affected versions (react-server-dom-parcel)
19.0.0, 19.0.1, 19.0.2, 19.0.3, 19.0.4, 19.0.5, 19.0.6, 19.0.7, 19.0.8, 19.1.0, 19.1.1, 19.1.2, 19.1.3, 19.1.4, 19.1.5, 19.1.6, 19.1.7, 19.1.8, 19.1.9, 19.2.0, 19.2.1, 19.2.2, 19.2.3, 19.2.4, 19.2.5, 19.2.6, 19.2.7, 19.2.8, 19.3.0As entered by the maintainer. Not reviewed.
Fixed in (react-server-dom-parcel)
19.0.9, 19.1.10, 19.2.9, 19.3.1
Affected versions (react-server-dom-turbopack)
19.0.0, 19.0.1, 19.0.2, 19.0.3, 19.0.4, 19.0.5, 19.0.6, 19.0.7, 19.0.8, 19.1.0, 19.1.1, 19.1.2, 19.1.3, 19.1.4, 19.1.5, 19.1.6, 19.1.7, 19.1.8, 19.1.9, 19.2.0, 19.2.1, 19.2.2, 19.2.3, 19.2.4, 19.2.5, 19.2.6, 19.2.7, 19.2.8, 19.3.0As entered by the maintainer. Not reviewed.
Fixed in (react-server-dom-turbopack)
19.0.9, 19.1.10, 19.2.9, 19.3.1
Affected versions (react-server-dom-webpack)
19.0.0, 19.0.1, 19.0.2, 19.0.3, 19.0.4, 19.0.5, 19.0.6, 19.0.7, 19.0.8, 19.1.0, 19.1.1, 19.1.2, 19.1.3, 19.1.4, 19.1.5, 19.1.6, 19.1.7, 19.1.8, 19.1.9, 19.2.0, 19.2.1, 19.2.2, 19.2.3, 19.2.4, 19.2.5, 19.2.6, 19.2.7, 19.2.8, 19.3.0As entered by the maintainer. Not reviewed.
Fixed in (react-server-dom-webpack)
19.0.9, 19.1.10, 19.2.9, 19.3.1
CVE
CVE-2026-126187 · published
GitHub Advisory Database
Reviewed
OSV.dev
Not checked
Other CVEs pointing here
None found in the CVE List

If you use react-server-dom-parcel 19.0.0, 19.0.1, 19.0.2, 19.0.3, 19.0.4, 19.0.5, 19.0.6, 19.0.7, 19.0.8, 19.1.0, 19.1.1, 19.1.2, 19.1.3, 19.1.4, 19.1.5, 19.1.6, 19.1.7, 19.1.8, 19.1.9, 19.2.0, 19.2.1, 19.2.2, 19.2.3, 19.2.4, 19.2.5, 19.2.6, 19.2.7, 19.2.8, 19.3.0

Upgrade to the fixed version for your release line: 19.0.9, 19.1.10, 19.2.9, 19.3.1. It’s in GitHub’s reviewed database now, so Dependabot, npm audit and OSV-Scanner can report it.

Timeline

  1. 2026-10-14 17:08 UTC

    Published by the maintainers

    Cites CVE-2026-126187

  2. 2026-10-28 07:19 UTC

    First seen by Limbowatch

    In limbo

  3. 2026-11-11 09:38 UTC

    Reviewed by GitHub

    Left limbo after 27 days

  4. 2026-11-11 09:38 UTC

    Change recorded

    cites CVE-2026-126187 (was none)