# cve.now: React

The newest entries affecting React (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-44907](https://cve.now/CVE-2026-44907.md): A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lea (CVSS 7.5, Meta react-server-dom-turbopack · Meta react-server-dom-… +4)
- [CVE-2026-23870](https://cve.now/CVE-2026-23870.md): A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lea (CVSS 7.5, Meta react-server-dom-turbopack · Meta react-server-dom-… +4)
- [CVE-2026-23869](https://cve.now/CVE-2026-23869.md): A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server (CVSS 7.5, Meta react-server-dom-turbopack · Meta react-server-dom-… +4)
- [CVE-2026-23864](https://cve.now/CVE-2026-23864.md): Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, reac (CVSS 7.5, Meta react-server-dom-webpack · Meta react-server-dom-tu… +4)
- [CVE-2025-67779](https://cve.now/CVE-2025-67779.md): It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attac (CVSS 7.5, Meta react-server-dom-parcel · Meta react-server-dom-tur… +4)
- [CVE-2025-55184](https://cve.now/CVE-2025-55184.md): A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2. (CVSS 7.5, Meta react-server-dom-webpack · Meta react-server-dom-tu… +4)
- [CVE-2025-55183](https://cve.now/CVE-2025-55183.md): An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1. (CVSS 5.3, Meta react-server-dom-webpack · Meta react-server-dom-tu… +4)
- [CVE-2025-55182](https://cve.now/CVE-2025-55182.md): A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclu (CVSS 10.0, KEV, Meta react-server-dom-webpack · Meta react-server-dom-tu… +4)
- [CVE-2025-3191](https://cve.now/CVE-2025-3191.md): All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result (CVSS 5.1, react-draft-wysiwyg)
- [CVE-2023-5654](https://cve.now/CVE-2023-5654.md): The React Developer Tools extension registers a message listener with window.addEventListener('message', \<listener\>) in a content script tha (CVSS 6.5, Meta React Developer Tools Extension · react-devtools-core)
- [CVE-2023-0365](https://cve.now/CVE-2023-0365.md): React Webcam \<= 1.2.0 - Contributor+ Stored XSS (no CVSS, React Webcam)
- [CVE-2022-24373](https://cve.now/CVE-2022-24373.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, react-native-reanimated)
- [CVE-2021-23398](https://cve.now/CVE-2021-23398.md): Cross-site Scripting (XSS) (CVSS 6.1, react-bootstrap-table)
- [CVE-2020-1920](https://cve.now/CVE-2020-1920.md): A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive reso (no CVSS, Facebook react-native · react-native)
- [CVE-2021-24033](https://cve.now/CVE-2021-24033.md): react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be (no CVSS, Facebook react-dev-utils · react-dev-utils)
- [CVE-2020-7787](https://cve.now/CVE-2020-7787.md): Improper Authentication (CVSS 8.2, react-adal)
- [CVE-2020-7696](https://cve.now/CVE-2020-7696.md): Information Exposure (CVSS 5.3, react-native-fast-image)
- [CVE-2018-6341](https://cve.now/CVE-2018-6341.md): React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. (CVSS 6.1, Facebook react-dom · react-dom)
- [CVE-2018-6342](https://cve.now/CVE-2018-6342.md): react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an edito (CVSS 9.8, Facebook react-dev-utils · react-dev-utils)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/react
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.