Skip to main content
cve.nowby Sazabi
← npm
npmPackage

react-server-dom-turbopack

8 known vulnerabilities (1 critical, 6 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
19.3.1 (Oct 14, 2026): no advisory affects it
Newest unaffected release
19.3.1 (Oct 14, 2026), the latest release
Advisories
8 · 1 critical, 6 high, 1 medium
Weekly downloads
74.3K
Dependents
1
Releases
500+ since 19.0.1 (Dec 3, 2025)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-44907
    Affects 19.0.1 to 19.0.7 (19.0.8 is outside it); 19.1.2 to 19.1.8 (19.1.9 is outside it); 19.2.0 to 19.2.7 (19.2.8 is outside it)
  • CVE-2026-23870
    Affects 19.0.1 to 19.0.5 (19.0.6 is outside it); 19.1.2 to 19.1.6 (19.1.7 is outside it); 19.2.0 to 19.2.5 (19.2.6 is outside it)
  • CVE-2026-23869
    Affects 19.0.1 to 19.0.4 (19.0.5 is outside it); 19.1.2 to 19.1.5 (19.1.6 is outside it); 19.2.0 to 19.2.4 (19.2.5 is outside it)
  • CVE-2026-23864
    Affects 19.0.1 to 19.0.3 (19.0.4 is outside it); 19.1.2 to 19.1.4 (19.1.5 is outside it); 19.2.0-canary-86181134-20251001 to 19.2.3 (19.2.4 is outside it)
  • CVE-2025-67779
    Affects 19.0.2 (19.0.3 is outside it); 19.1.3 (19.1.4 is outside it); 19.2.2 (19.2.3 is outside it)
  • CVE-2025-55184
    Affects 19.0.1 (19.0.2 is outside it); 19.1.2 (19.1.3 is outside it); 19.2.0 to 19.2.1 (19.2.2 is outside it)
  • CVE-2025-55183
    Affects 19.0.1 (19.0.2 is outside it); 19.1.2 (19.1.3 is outside it); 19.2.0 to 19.2.1 (19.2.2 is outside it)
  • CVE-2025-55182
    Affects 19.2.0 (19.2.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 8

  • A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could…

    Affected: from 19.0.0, fixed in 19.0.8; from 19.1.0, fixed in 19.1.9; from 19.2.0, fixed in 19.2.8.

    Fixed in 19.0.8 (released Jul 21, 2026, the day of disclosure), 19.1.9 (released Jul 21, 2026, the day of disclosure) and 19.2.8 (released Jul 21, 2026, the day of disclosure).

    The latest release, 19.3.1, is not affected.

    37% of react-server-dom-turbopack downloads last week were affected versions (20.3K).

  • A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could…

    Affected: from 19.0.0, fixed in 19.0.6; from 19.1.0, fixed in 19.1.7; from 19.2.0, fixed in 19.2.6.

    Fixed in 19.0.6 (released May 6, 2026, the day of disclosure), 19.1.7 (released May 6, 2026, the day of disclosure) and 19.2.6 (released May 6, 2026, the day of disclosure).

    The latest release, 19.3.1, is not affected.

    23% of react-server-dom-turbopack downloads last week were affected versions (12.5K).

  • A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel…

    Affected: from 19.0.0, fixed in 19.0.5; from 19.1.0, fixed in 19.1.6; from 19.2.0, fixed in 19.2.5.

    Fixed in 19.0.5 (released Apr 8, 2026, the day of disclosure), 19.1.6 (released Apr 8, 2026, the day of disclosure) and 19.2.5 (released Apr 8, 2026, the day of disclosure).

    The latest release, 19.3.1, is not affected.

    12% of react-server-dom-turbopack downloads last week were affected versions (6.4K).

  • Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel…

    Affected: from 19.1.0-canary-7130d0c6-20241212, fixed in 19.1.5; from 19.0.0, fixed in 19.0.4; from 19.2.0-canary-63779030-20250328, fixed in 19.2.4.

    Fixed in 19.0.4 (released Jan 26, 2026, the day of disclosure), 19.1.5 (released Jan 26, 2026, the day of disclosure) and 19.2.4 (released Jan 26, 2026, the day of disclosure).

    The latest release, 19.3.1, is not affected.

    10% of react-server-dom-turbopack downloads last week were affected versions (5.7K).

  • It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service…

    Affected: from 19.0.2, fixed in 19.0.3; from 19.1.3, fixed in 19.1.4; from 19.2.2, fixed in 19.2.3.

    Fixed in 19.0.3 (released Dec 11, 2025, the day of disclosure), 19.1.4 (released Dec 11, 2025, the day of disclosure) and 19.2.3 (released Dec 11, 2025, the day of disclosure).

    The latest release, 19.3.1, is not affected.

    <0.1% of react-server-dom-turbopack downloads last week were affected versions (37).

  • A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2…

    Affected: from 19.0.0, fixed in 19.0.2; from 19.1.0, fixed in 19.1.3; from 19.2.0, fixed in 19.2.2.

    Fixed in 19.0.2 (released Dec 11, 2025, the day of disclosure), 19.1.3 (released Dec 11, 2025, the day of disclosure) and 19.2.2 (released Dec 11, 2025, the day of disclosure).

    The latest release, 19.3.1, is not affected.

    3.9% of react-server-dom-turbopack downloads last week were affected versions (2.2K).

  • CVE-2025-55183Medium 5.3

    An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1…

    Affected: from 19.0.0, fixed in 19.0.2; from 19.1.0, fixed in 19.1.3; from 19.2.0, fixed in 19.2.2.

    Fixed in 19.0.2 (released Dec 11, 2025, the day of disclosure), 19.1.3 (released Dec 11, 2025, the day of disclosure) and 19.2.2 (released Dec 11, 2025, the day of disclosure).

    The latest release, 19.3.1, is not affected.

    3.9% of react-server-dom-turbopack downloads last week were affected versions (2.2K).

  • CVE-2025-55182Critical 10.0 · KEV

    A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0…

    Affected: from 19.0.0, fixed in 19.0.1; from 19.1.0, fixed in 19.1.2; from 19.2.0, fixed in 19.2.1.

    Fixed in 19.0.1 (released Dec 3, 2025, the day of disclosure), 19.1.2 (released Dec 3, 2025, the day of disclosure) and 19.2.1 (released Dec 3, 2025, the day of disclosure).

    The latest release, 19.3.1, is not affected.

    3.5% of react-server-dom-turbopack downloads last week were affected versions (1.9K).