# react-server-dom-turbopack (npm) vulnerabilities 8 known vulnerabilities (1 critical, 6 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 19.3.1 (Oct 14, 2026): no advisory affects it - Newest unaffected release: 19.3.1 (Oct 14, 2026), the latest release - Weekly downloads: 74.3K - Dependents: 1 - Releases: 500+ since 19.0.1 (Dec 3, 2025) - Registry: https://www.npmjs.com/package/react-server-dom-turbopack - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-44907: 19.0.1 to 19.0.7 (19.0.8 is outside it); 19.1.2 to 19.1.8 (19.1.9 is outside it); 19.2.0 to 19.2.7 (19.2.8 is outside it) - CVE-2026-23870: 19.0.1 to 19.0.5 (19.0.6 is outside it); 19.1.2 to 19.1.6 (19.1.7 is outside it); 19.2.0 to 19.2.5 (19.2.6 is outside it) - CVE-2026-23869: 19.0.1 to 19.0.4 (19.0.5 is outside it); 19.1.2 to 19.1.5 (19.1.6 is outside it); 19.2.0 to 19.2.4 (19.2.5 is outside it) - CVE-2026-23864: 19.0.1 to 19.0.3 (19.0.4 is outside it); 19.1.2 to 19.1.4 (19.1.5 is outside it); 19.2.0-canary-86181134-20251001 to 19.2.3 (19.2.4 is outside it) - CVE-2025-67779: 19.0.2 (19.0.3 is outside it); 19.1.3 (19.1.4 is outside it); 19.2.2 (19.2.3 is outside it) - CVE-2025-55184: 19.0.1 (19.0.2 is outside it); 19.1.2 (19.1.3 is outside it); 19.2.0 to 19.2.1 (19.2.2 is outside it) - CVE-2025-55183: 19.0.1 (19.0.2 is outside it); 19.1.2 (19.1.3 is outside it); 19.2.0 to 19.2.1 (19.2.2 is outside it) - CVE-2025-55182: 19.2.0 (19.2.1 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (8) ### [CVE-2026-44907](https://cve.now/CVE-2026-44907): A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could… - Severity: High 7.5 - Published: Jul 21, 2026 - Affected: from 19.0.0, fixed in 19.0.8; from 19.1.0, fixed in 19.1.9; from 19.2.0, fixed in 19.2.8. - Fixed in 19.0.8 (released Jul 21, 2026, the day of disclosure), 19.1.9 (released Jul 21, 2026, the day of disclosure) and 19.2.8 (released Jul 21, 2026, the day of disclosure). - The latest release, 19.3.1, is not affected. - 37% of react-server-dom-turbopack downloads last week were affected versions (20.3K). ### [CVE-2026-23870](https://cve.now/CVE-2026-23870): A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could… - Severity: High 7.5 - Published: May 6, 2026 - Affected: from 19.0.0, fixed in 19.0.6; from 19.1.0, fixed in 19.1.7; from 19.2.0, fixed in 19.2.6. - Fixed in 19.0.6 (released May 6, 2026, the day of disclosure), 19.1.7 (released May 6, 2026, the day of disclosure) and 19.2.6 (released May 6, 2026, the day of disclosure). - The latest release, 19.3.1, is not affected. - 23% of react-server-dom-turbopack downloads last week were affected versions (12.5K). ### [CVE-2026-23869](https://cve.now/CVE-2026-23869): A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel… - Severity: High 7.5 - Published: Apr 8, 2026 - Affected: from 19.0.0, fixed in 19.0.5; from 19.1.0, fixed in 19.1.6; from 19.2.0, fixed in 19.2.5. - Fixed in 19.0.5 (released Apr 8, 2026, the day of disclosure), 19.1.6 (released Apr 8, 2026, the day of disclosure) and 19.2.5 (released Apr 8, 2026, the day of disclosure). - The latest release, 19.3.1, is not affected. - 12% of react-server-dom-turbopack downloads last week were affected versions (6.4K). ### [CVE-2026-23864](https://cve.now/CVE-2026-23864): Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel… - Severity: High 7.5 - Published: Jan 26, 2026 - Affected: from 19.1.0-canary-7130d0c6-20241212, fixed in 19.1.5; from 19.0.0, fixed in 19.0.4; from 19.2.0-canary-63779030-20250328, fixed in 19.2.4. - Fixed in 19.0.4 (released Jan 26, 2026, the day of disclosure), 19.1.5 (released Jan 26, 2026, the day of disclosure) and 19.2.4 (released Jan 26, 2026, the day of disclosure). - The latest release, 19.3.1, is not affected. - 10% of react-server-dom-turbopack downloads last week were affected versions (5.7K). ### [CVE-2025-67779](https://cve.now/CVE-2025-67779): It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service… - Severity: High 7.5 - Published: Dec 11, 2025 - Affected: from 19.0.2, fixed in 19.0.3; from 19.1.3, fixed in 19.1.4; from 19.2.2, fixed in 19.2.3. - Fixed in 19.0.3 (released Dec 11, 2025, the day of disclosure), 19.1.4 (released Dec 11, 2025, the day of disclosure) and 19.2.3 (released Dec 11, 2025, the day of disclosure). - The latest release, 19.3.1, is not affected. - <0.1% of react-server-dom-turbopack downloads last week were affected versions (37). ### [CVE-2025-55184](https://cve.now/CVE-2025-55184): A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2… - Severity: High 7.5 - Published: Dec 11, 2025 - Affected: from 19.0.0, fixed in 19.0.2; from 19.1.0, fixed in 19.1.3; from 19.2.0, fixed in 19.2.2. - Fixed in 19.0.2 (released Dec 11, 2025, the day of disclosure), 19.1.3 (released Dec 11, 2025, the day of disclosure) and 19.2.2 (released Dec 11, 2025, the day of disclosure). - The latest release, 19.3.1, is not affected. - 3.9% of react-server-dom-turbopack downloads last week were affected versions (2.2K). ### [CVE-2025-55183](https://cve.now/CVE-2025-55183): An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1… - Severity: Medium 5.3 - Published: Dec 11, 2025 - Affected: from 19.0.0, fixed in 19.0.2; from 19.1.0, fixed in 19.1.3; from 19.2.0, fixed in 19.2.2. - Fixed in 19.0.2 (released Dec 11, 2025, the day of disclosure), 19.1.3 (released Dec 11, 2025, the day of disclosure) and 19.2.2 (released Dec 11, 2025, the day of disclosure). - The latest release, 19.3.1, is not affected. - 3.9% of react-server-dom-turbopack downloads last week were affected versions (2.2K). ### [CVE-2025-55182](https://cve.now/CVE-2025-55182): A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0… - Severity: Critical 10.0 · KEV - Published: Dec 3, 2025 - Affected: from 19.0.0, fixed in 19.0.1; from 19.1.0, fixed in 19.1.2; from 19.2.0, fixed in 19.2.1. - Fixed in 19.0.1 (released Dec 3, 2025, the day of disclosure), 19.1.2 (released Dec 3, 2025, the day of disclosure) and 19.2.1 (released Dec 3, 2025, the day of disclosure). - The latest release, 19.3.1, is not affected. - 3.5% of react-server-dom-turbopack downloads last week were affected versions (1.9K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/react-server-dom-turbopack Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.