React CVE feed and alerts
Every new CVE and security advisory affecting React, merged from the CVE List, GitHub, OSV, NVD and CISA KEV into one entry each, with severity, exploitation status and fixed versions. New entries appear within minutes of their source. The feeds are free and need no API key; the newest 200 are listed below.
- Critical
- 3
- High
- 7
- On CISA KEV
- 1
Of the newest 17
- CVE-2026-126187React remote code execution in server componentsreact · react-server-dom-parcel +2
- CVE-2026-44907A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following…Meta react-server-dom-turbopack · Meta react-server-dom-… +4
- CVE-2026-23870A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive…Meta react-server-dom-turbopack · Meta react-server-dom-… +4
- CVE-2026-23869A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions…Meta react-server-dom-turbopack · Meta react-server-dom-… +4
- CVE-2026-23864Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpackMeta react-server-dom-webpack · Meta react-server-dom-tu… +4
- CVE-2025-67779It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific caseMeta react-server-dom-parcel · Meta react-server-dom-tur… +4
- CVE-2025-55184A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages…Meta react-server-dom-webpack · Meta react-server-dom-tu… +4
- CVE-2025-55183An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages…Meta react-server-dom-webpack · Meta react-server-dom-tu… +4
- CVE-2025-55182React pre-auth remote code execution in server function endpointsMeta react-server-dom-webpack · Meta react-server-dom-tu… +4
- CVE-2025-3191All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the <iframe> tagreact-draft-wysiwyg
- CVE-2023-5654The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browserMeta React Developer Tools Extension · react-devtools-core
- CVE-2023-0365React Webcam <= 1.2.0 - Contributor+ Stored XSSReact Webcam
- CVE-2021-23398Cross-site Scripting (XSS)react-bootstrap-table
- CVE-2020-7787Improper Authenticationreact-adal
- CVE-2020-7696Information Exposurereact-native-fast-image
- CVE-2018-6341React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-timeFacebook react-dom · react-dom
- CVE-2018-6342react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editorFacebook react-dev-utils · react-dev-utils
Get alerts for new React CVEs
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/feed?tech=react
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/feed?tech=react in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/feed?tech=react&format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/feed?tech=react&format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What are the latest React CVEs?
The newest are CVE-2026-126187 (React remote code execution in server components); CVE-2026-44907 (A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following…); CVE-2026-23870 (A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive…).
Are any React CVEs being exploited?
1 of the 17 newest React vulnerabilities are on CISA's Known Exploited Vulnerabilities list: CVE-2025-55182.
How many critical React CVEs are there?
3 of the 17 newest are rated critical (CVSS 9.0 or higher, or rated critical by their source when they have no score): CVE-2026-126187, CVE-2025-55182, CVE-2018-6342.
How do I get alerts for new React CVEs?
Subscribe to this page's RSS, Atom or JSON feed, or connect a coding agent to the cve.now MCP server. Each new entry appears within minutes of its source.
Is there an RSS feed of React CVEs?
Yes: https://cve.now/feed?tech=react. Add format=atom or format=json for Atom or JSON Feed. It is free and needs no account or API key.
How do I get React CVEs in Slack or by email?
In Slack, run /feed subscribe https://cve.now/feed?tech=react. For email, give the RSS URL to any RSS-to-email service.