Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: Meta Component: React Clear all filters
TI-2026-19225 CVE-2026-23864 · GHSA-83fc-fqcc-2hmg

Uncontrolled resource consumption in Meta react-server-dom-webpack

Priority MEDIUM 44

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02581 Published 2026-01-26 Fixed in 19.0.4, 19.1.5 +1 CWE-400
TI-2025-41449 CVE-2025-67779 · GHSA-7gmr-mq3h-m5h9

Uncontrolled resource consumption in Meta react-server-dom-parcel

Priority MEDIUM 57

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.19986 Published 2025-12-11 Fixed in 19.0.3, 19.1.4 +1 CWE-400
TI-2025-34863 CVE-2025-55184 · GHSA-2m3v-v2m8-q956

Deserialization of untrusted data in Meta react-server-dom-webpack

Priority HIGH 75

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-s…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.66615 Published 2025-12-11 Fixed in 19.0.2, 19.1.3 +1 CWE-502
TI-2025-34862 CVE-2025-55183 · GHSA-925w-6v3x-g4j4

Deserialization of untrusted data in Meta react-server-dom-webpack

Priority HIGH 66

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel,…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.64233 Published 2025-12-11 Fixed in 19.0.2, 19.1.3 +1 CWE-497
TI-2025-34861 CVE-2025-55182 · GHSA-fv66-9v8q-g76r

Deserialization of untrusted data in Meta react-server-dom-webpack

Priority CRITICAL 100KEV

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99731 Published 2025-12-03 Fixed in 19.0.1, 19.1.2 +1 CWE-502
TI-2018-04665 CVE-2018-6341 · GHSA-mvjj-gqq2-p4hw

Cross-site scripting in Meta react-dom

Priority LOW 33

React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.03426 Published 2018-12-31 Fixed in 16.0.1, 16.1.2 +3 CWE-79