Read the docs

Meta

Records192All Threatist records
Exploited (KEV)5In CISA KEV
CVSS critical74CVSS 9.0–10.0
CVSS high79CVSS 7.0–8.9

Exploited now

Meta records in CISA KEV
TI-2025-34861 Meta React Server Components Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2025-12-05TI-2025-34857 Meta Platforms WhatsApp Incorrect Authorization Vulnerability Priority HIGH 84KEV 2025-09-02TI-2023-23979 HTTP/2 Rapid Reset Attack Vulnerability Priority CRITICAL 90KEV 2023-10-10TI-2019-13416 WhatsApp Cross-Site Scripting Vulnerability Priority CRITICAL 93KEV 2022-05-23TI-2019-02633 WhatsApp VOIP Stack Buffer Overflow Vulnerability Priority CRITICAL 100KEV 2022-04-19

Components

Products in the NVD configurations · select one to filter the records
Hhvm 40 records MEDIUM Hermes 20 records MEDIUM Thrift 9 records MEDIUM Hiphop Virtual Machine 7 records MEDIUM Proxygen 7 records CRITICAL React 6 records CRITICAL Facebook 4 records HIGH Zstandard 4 records MEDIUM

Records

6 records in React · all components

TI-2025-34861 CVE-2025-55182 · GHSA-fv66-9v8q-g76r

Deserialization of untrusted data in Meta react-server-dom-webpack

Priority CRITICAL 100KEV

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99731 Published 2025-12-03 Fixed in 19.0.1, 19.1.2 +1 CWE-502
TI-2025-34863 CVE-2025-55184 · GHSA-2m3v-v2m8-q956

Deserialization of untrusted data in Meta react-server-dom-webpack

Priority HIGH 75

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-s…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.66615 Published 2025-12-11 Fixed in 19.0.2, 19.1.3 +1 CWE-502
TI-2025-34862 CVE-2025-55183 · GHSA-925w-6v3x-g4j4

Deserialization of untrusted data in Meta react-server-dom-webpack

Priority HIGH 66

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel,…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.64233 Published 2025-12-11 Fixed in 19.0.2, 19.1.3 +1 CWE-497
TI-2025-41449 CVE-2025-67779 · GHSA-7gmr-mq3h-m5h9

Uncontrolled resource consumption in Meta react-server-dom-parcel

Priority MEDIUM 57

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.19986 Published 2025-12-11 Fixed in 19.0.3, 19.1.4 +1 CWE-400
TI-2026-19225 CVE-2026-23864 · GHSA-83fc-fqcc-2hmg

Uncontrolled resource consumption in Meta react-server-dom-webpack

Priority MEDIUM 44

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02581 Published 2026-01-26 Fixed in 19.0.4, 19.1.5 +1 CWE-400
TI-2018-04665 CVE-2018-6341 · GHSA-mvjj-gqq2-p4hw

Cross-site scripting in Meta react-dom

Priority LOW 33

React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.03426 Published 2018-12-31 Fixed in 16.0.1, 16.1.2 +3 CWE-79
Open these records in search →