GitHub's Advisory Database said on 10 November that crafted payloads can lead to remote code execution in frameworks that support React Server Components. In plain terms, an attacker could run their own code on the server. The advisory's title says no login is needed. Affected releases are 19.0.0 to 19.0.8, 19.1.0 to 19.1.9, 19.2.0 to 19.2.8, and 19.3.0. Teams on those lines can move to 19.0.9, 19.1.10, 19.2.9 or 19.3.1, which carry the fix.
The advisory says the flaw only affects extremely rare cases. A response must carry several typed arrays, which are blocks of raw numbers, along with a value the attacker controls. Apps are not affected if their React code uses no server. They are also safe if no framework, bundler or bundler plugin they use supports Server Components. The advisory does not say whether anyone has used the flaw in attacks. It gives no count of exposed apps.
Our reading: running the affected code is not the same as meeting the trigger. The advisory limits exploitability to the rare case, so the first task is an inventory. Check whether your tooling supports Server Components and which React version it uses, then upgrade, as the advisory urges. It is also worth asking who owns framework upgrades.