Skip to content
Facebook React vulnerabilities
-
facebook react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack +2 more
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
CVE-2026-23870
Public exploitFix available
7.5 High
-
facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +3 more +5 more
React Server Components have multiple Denial of Service Vulnerabilities
CVE-2026-23864
Fix available
7.5 High
-
facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 more
Denial of Service Vulnerability in React Server Components
CVE-2025-67779
Fix available
EPSS 20.0%
7.5 High
-
facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 more
Denial of Service Vulnerability in React Server Components
CVE-2025-55184
Public exploitFix available
EPSS 66.6%
7.5 High
-
facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 more
Source Code Exposure Vulnerability in React Server Components
CVE-2025-55183
Public exploitFix available
EPSS 64.2%
5.3 Medium
-
facebook react, meta react server components, react-server-dom-parcel +3 more +5 more
React Server Components are Vulnerable to RCE
CVE-2025-55182
In KEVPublic exploitFix available
EPSS 99.8%
10.0 Critical
-
meta react developer tools extension, facebook react-devtools +1 more
React Developer Tools extension Improper Authorization vulnerability
CVE-2023-5654
Fix available
6.5 Medium
-
facebook react-native
Regular expression denial of service in react-native
CVE-2020-1920
Fix available
7.5 High
-
facebook react-dev-utils
react-dev-utils OS Command Injection in function `getProcessForPort`
CVE-2021-24033
Fix available
5.6 Medium
-
facebook react-dev-utils
react-dev-utils on Windows vulnerable to Remote Code Execution
CVE-2018-6342
Fix available
9.8 Critical
-
facebook react, react-dom +1 more
Cross-Site Scripting in react-dom
CVE-2018-6341
Public exploitFix available
6.1 Medium