React vulnerabilities
The newest vulnerabilities affecting React, up to 200. Subscribe by RSS.
- CVE-2026-44907A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could leaMeta react-server-dom-turbopack · Meta react-server-dom-… +4
- CVE-2026-23870A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could leaMeta react-server-dom-turbopack · Meta react-server-dom-… +4
- CVE-2026-23869A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-serverMeta react-server-dom-turbopack · Meta react-server-dom-… +4
- CVE-2026-23864Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, reacMeta react-server-dom-webpack · Meta react-server-dom-tu… +4
- CVE-2025-67779It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attacMeta react-server-dom-parcel · Meta react-server-dom-tur… +4
- CVE-2025-55184A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.Meta react-server-dom-webpack · Meta react-server-dom-tu… +4
- CVE-2025-55183An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.Meta react-server-dom-webpack · Meta react-server-dom-tu… +4
- CVE-2025-55182A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 incluMeta react-server-dom-webpack · Meta react-server-dom-tu… +4
- CVE-2025-3191All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result react-draft-wysiwyg
- CVE-2023-5654The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script thaMeta React Developer Tools Extension · react-devtools-core
- CVE-2023-0365React Webcam <= 1.2.0 - Contributor+ Stored XSSReact Webcam
- CVE-2022-24373Regular Expression Denial of Service (ReDoS)react-native-reanimated
- CVE-2021-23398Cross-site Scripting (XSS)react-bootstrap-table
- CVE-2020-1920A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resoFacebook react-native · react-native
- CVE-2021-24033react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be Facebook react-dev-utils · react-dev-utils
- CVE-2020-7787Improper Authenticationreact-adal
- CVE-2020-7696Information Exposurereact-native-fast-image
- CVE-2018-6341React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time.Facebook react-dom · react-dom
- CVE-2018-6342react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editoFacebook react-dev-utils · react-dev-utils