Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2026-23870

Denial of Service via Crafted HTTP Requests in Meta’s React Server DOM Packages

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Facebook
Products
React-server-dom-parcel React-server-dom-turbopack React-server-dom-webpack
CVE-2026-44907

Excessive CPU Resource Exhaustion Denial of Service in Meta's React Server DOM Packages

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Facebook
Products
React-server-dom-parcel React-server-dom-turbopack React-server-dom-webpack
CVE-2026-23864

react-server-dom-webpack: react-server-dom-parcel: reactreact-server-dom-turbopack: React Server Components: Denial of Service via specially crafted HTTP requests

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code. Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Facebook
Products
React React-server-dom-parcel React-server-dom-turbopack and 1 more
CVE-2026-23869

react-server-dom-parcel: react-server-dom-turbopack: react-server-dom-webpack: denial of service via specially crafted HTTP requests to Server Function endpoints

A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Facebook
Products
React-server-dom-parcel React-server-dom-turbopack React-server-dom-webpack
CVE-2025-55182

next: From CVEorg collector

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

CVSS 3.1 · 10 Critical EPSS 99.7% KEV · Listed
Vendors
Facebook Vercel
Products
React React-server-dom-parcel React-server-dom-turbopack and 2 more
CVE-2025-55183

next: React Server Components: Source code exposure through crafted HTTP request

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.

CVSS 3.1 · 5.3 Medium EPSS 61.9% KEV · Not listed
Vendors
Facebook Vercel
Products
React React-server-dom-parcel React-server-dom-turbopack and 2 more
CVE-2025-55184

next: React Server Components: Denial of Service via unsafe HTTP deserialization

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

CVSS 3.1 · 7.5 High EPSS 64.4% KEV · Not listed
Vendors
Facebook Vercel
Products
React React-server-dom-parcel React-server-dom-turbopack and 2 more
CVE-2025-67779

next: React Server Components: Denial of Service via Unsafe Deserialization

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.

CVSS 3.1 · 7.5 High EPSS 15.5% KEV · Not listed
Vendors
Facebook Vercel
Products
React React-server-dom-parcel React-server-dom-turbopack and 2 more