Meta vulnerabilities
We track 7 vulnerabilities in Meta products across 4 products. 7 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on May 6, 2026.
Latest Meta vulnerabilities
- 7.5 High severity
react-server-dom-turbopack: Uncontrolled Resource Consumption
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom
- 7.5 High severity
react-server-dom-turbopack: Uncontrolled Resource Consumption
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 1
- 7.5 High severity
react-server-dom-webpack: Uncontrolled Resource Consumption
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP re
- 7.5 High severity
react-server-dom-parcel: Deserialization of Untrusted Data
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deseriali
- 7.5 High severity
react-server-dom-webpack: Deserialization of Untrusted Data
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-do
- 10.0 Critical severity
Meta React Server Components Remote Code Execution Exploited
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vuln
- 9.8 Critical severity
tac_plus: Improper Filtering of Special Elements
A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent to tac_plus to inject shell commands and gain remote code ex