A critical remote code execution vulnerability exists in React Server Components affecting react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0. The flaw can be exploited via crafted payloads involving multiple typed arrays and attacker-controlled values. Fixed versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1 have been released and immediate upgrading is recommended. Applications not using React Server Components or the affected frameworks are not impacted.