React security vulnerabilities
Developer framework / library. Public CVE monitoring for React. Vendor security advisories are linked on this page.
Built for Operators of this product.
12 public records · 0 security-fix timeline events. 0 published in the last 7 days. 12 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 1
- High 2
- Medium 0
- Low 0
2026-08-053 issues2026-11-02
Known exploited
View all known exploitedRecently published
Browse catalog- High7.5react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP.Check if you run itEPSS 0.52%Oct 15, 2026
- CriticalUnauthenticated Remote Code Execution in React Server ComponentsOpen the advisoryOct 14, 2026
- High7.5Denial of Service Vulnerabilities in React Server ComponentsCheck if you run itEPSS 2.58%Jan 26, 2026
- High7.5@vitejs/plugin-rs provides React Server Components (RSC) support for Vite.Check if you run itEPSS 0.50%Dec 16, 2025
- High7.5It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case.Check this weekEPSS 19.99%Dec 11, 2025
- High7.5facebook react Deserialization of Untrusted DataPatch nowKEVEPSS 66.62%Dec 11, 2025
- Medium5.3An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the follCheck this weekEPSS 64.23%Dec 11, 2025
- Critical10.0Meta React Server Components Remote Code Execution VulnerabilityPatch nowKEVEPSS 99.80%Dec 3, 2025