React (Facebook) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 151 known versions, newest CVE from 2026-01-26. Vendor: Facebook.

CVEs of React

• CVE-2026-23864 - CVSS 7.5 (high), 2026-01-26: Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel,…
• CVE-2025-67779 - CVSS 7.5 (high), 2025-12-12: It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific…
• CVE-2025-55184 - CVSS 7.5 (high), 2025-12-11: A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1,…
• CVE-2025-55183 - CVSS 5.3 (medium), 2025-12-11: An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and…
• CVE-2025-55182 - CVSS 10 (critical), 2025-12-03: A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following…
• CVE-2018-6341 - CVSS 6.1 (medium), 2018-12-31: React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping…