briskets/CVE-2026-126187-poc: React Server Components Unauthenticated RCE Exploit and Lab

This repository provides a proof-of-concept exploit and a vulnerable Docker lab for CVE-2026-126187, an unauthenticated remote code execution vulnerability affecting React Server Components and Next.js. The vulnerability stems from a Flight serializer bug involving shared ArrayBuffers and multiple typed arrays, allowing an attacker to forge rows and invoke real Server Actions. The repository includes an exploitation script, a vulnerable lab environment, and guidance on how to audit and patch affected systems. Open article →