ThinkFacility Sign in
  1. Home
  2. Security
  3. npm package (react-server-dom-webpack)
Criticalnpm package (react-server-dom-webpack)

React Server Components 19.0 to 19.3: a critical remote code execution flaw, update now

Developers whose apps render React Server Components on a server, through a framework or a bundler plugin that supports them.

How to fix it

You haveUpdate to
>= 19.0.0, < 19.0.9→19.0.9>= 19.1.0, < 19.1.10→19.1.10>= 19.2.0, < 19.2.9→19.2.9>= 19.3.0, < 19.3.1→19.3.1

Check your version

Which version your project has
npm ls react-server-dom-webpack

Update

In your project
npm update react-server-dom-webpack
npm ls react-server-dom-webpack
Still old? A dependency pins it
npm explain react-server-dom-webpack
Then check what's left
npm audit

react-server-dom-parcel and react-server-dom-turbopack have the same flaw and the same fixed versions, so update whichever your app has. React says it only bites in rare cases where a response carries several typed arrays and a value the attacker controls. If your React code doesn't run on a server, you aren't affected.

If npm ls still shows an old version under another package, update that package, or add an "overrides" entry for this one in package.json.

Sources