Critical Remote Code Execution Flaw Discovered in React Server Components

A critical security vulnerability, tracked as GHSA-xqc2-xf4c-x3h3, has been identified in React Server Components, allowing attackers to execute code remotely without authentication. The flaw affects `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` packages, with a CVSS v4 score of 9.5. React recommends immediate updates for affected applications, with fixed releases including 19.0.9, 19.1.10, 19.2.9, and 19.3.1.