react-server-dom-webpack vulnerabilities

6 known vulnerabilities in react-server-dom-webpack from Meta. 6 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  react-server-dom-turbopack: Uncontrolled Resource Consumption

  CVE-2026-23870May 6, 2026MetaEPSS 1.53%

  A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom

• 7.5 High severity

  react-server-dom-turbopack: Uncontrolled Resource Consumption

  CVE-2026-23869Apr 8, 2026MetaEPSS 1.57%

  A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 1

• 7.5 High severity

  react-server-dom-webpack: Uncontrolled Resource Consumption

  CVE-2026-23864Jan 26, 2026MetaEPSS 2.58%

  Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP re

• 7.5 High severity

  react-server-dom-parcel: Deserialization of Untrusted Data

  CVE-2025-67779Dec 12, 2025MetaEPSS 15.5%

  It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deseriali

• 7.5 High severity

  react-server-dom-webpack: Deserialization of Untrusted Data

  CVE-2025-55184Dec 11, 2025MetaEPSS 64.4%

  A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-do

• 10.0 Critical severity

  Meta React Server Components Remote Code Execution Exploited

  CVE-2025-55182Dec 3, 2025MetaEPSS 99.7%

  A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vuln