# cve.now: React The newest entries affecting React (up to 200). Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-126187](https://cve.now/CVE-2026-126187.md): React remote code execution in server components (CVSS 9.5, needs attention: First public exploit on GitHub Nov 11, react · react-server-dom-parcel +2) - [CVE-2026-44907](https://cve.now/CVE-2026-44907.md): A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following… (CVSS 7.5, Meta react-server-dom-turbopack · Meta react-server-dom-… +4) - [CVE-2026-23870](https://cve.now/CVE-2026-23870.md): A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive… (CVSS 7.5, Meta react-server-dom-turbopack · Meta react-server-dom-… +4) - [CVE-2026-23869](https://cve.now/CVE-2026-23869.md): A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions… (CVSS 7.5, Meta react-server-dom-turbopack · Meta react-server-dom-… +4) - [CVE-2026-23864](https://cve.now/CVE-2026-23864.md): Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack (CVSS 7.5, Meta react-server-dom-webpack · Meta react-server-dom-tu… +4) - [CVE-2025-67779](https://cve.now/CVE-2025-67779.md): It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case (CVSS 7.5, Meta react-server-dom-parcel · Meta react-server-dom-tur… +4) - [CVE-2025-55184](https://cve.now/CVE-2025-55184.md): A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages… (CVSS 7.5, Meta react-server-dom-webpack · Meta react-server-dom-tu… +4) - [CVE-2025-55183](https://cve.now/CVE-2025-55183.md): An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages… (CVSS 5.3, Meta react-server-dom-webpack · Meta react-server-dom-tu… +4) - [CVE-2025-55182](https://cve.now/CVE-2025-55182.md): React pre-auth remote code execution in server function endpoints (CVSS 10.0, KEV, Meta react-server-dom-webpack · Meta react-server-dom-tu… +4) - [CVE-2025-3191](https://cve.now/CVE-2025-3191.md): All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the \ tag (CVSS 5.1, react-draft-wysiwyg) - [CVE-2023-5654](https://cve.now/CVE-2023-5654.md): The React Developer Tools extension registers a message listener with window.addEventListener('message', \) in a content script that is accessible to any webpage that is active in the browser (CVSS 6.5, Meta React Developer Tools Extension · react-devtools-core) - [CVE-2023-0365](https://cve.now/CVE-2023-0365.md): React Webcam \<= 1.2.0 - Contributor+ Stored XSS (CVSS 5.4, React Webcam) - [CVE-2021-23398](https://cve.now/CVE-2021-23398.md): Cross-site Scripting (XSS) (CVSS 6.1, react-bootstrap-table) - [CVE-2020-7787](https://cve.now/CVE-2020-7787.md): Improper Authentication (CVSS 8.2, react-adal) - [CVE-2020-7696](https://cve.now/CVE-2020-7696.md): Information Exposure (CVSS 5.3, react-native-fast-image) - [CVE-2018-6341](https://cve.now/CVE-2018-6341.md): React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time (CVSS 6.1, Facebook react-dom · react-dom) - [CVE-2018-6342](https://cve.now/CVE-2018-6342.md): react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor (CVSS 9.8, Facebook react-dev-utils · react-dev-utils) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/tech/react Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.