Go to packages list

react-server-dom-webpack

Ecosystem: npm

Downloads: 9.43 Mln

Vulnerabilities from the last (months)
  • 1CriticalAffects 3 versions
  • 6HighAffects 18 versions
  • 0MediumAffects 0 versions
  • 1ModerateAffects 3 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
8vulnerabilities
  • Critical1 (12.5%)
  • High6 (75.0%)
  • Medium0 (0.0%)
  • Moderate1 (12.5%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 4 vulnerabilities
    • Critical: 1
    • High: 2
    • Medium: 0
    • Moderate: 1
    • Low: 0

Vulnerabilities (8)

Known vulnerabilities affecting react-server-dom-webpack, based on data from OSV.

Vulnerabilities affecting react-server-dom-webpack
IDSeveritySummaryAffected versionsPublishedSource
GHSA-wx67-qw84-cm4gHighreact-server-dom: Denial of Service in Server Functions### Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of: - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack ### Patches Fixes were back ported to versions 19.0.8, 19.1.9, and 19.2.8. If you are using any of the above packages please upgrade to any of the fixed versio
  • >= 19.0.0, < 19.0.8
  • >= 19.1.0, < 19.1.9
  • >= 19.2.0, < 19.2.8
GitHub (opens in a new tab)
GHSA-rv78-f8rc-xrxhHighFacebook React has a Denial of Service Vulnerability in React Server Components## Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of: [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turb
  • >= 19.0.0, < 19.0.6
  • >= 19.1.0, < 19.1.7
  • >= 19.2.0, < 19.2.6
GitHub (opens in a new tab)
GHSA-479c-33wc-g2pgHighReact Server Components have a Denial of Service Vulnerability## Impact A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack versions 19.0.0, 19.1.0 and 19.2.0. The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints. The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4
  • >= 19.0.0, < 19.0.5
  • >= 19.1.0, < 19.1.6
  • >= 19.2.0, < 19.2.5
GitHub (opens in a new tab)
GHSA-83fc-fqcc-2hmgHighReact Server Components have multiple Denial of Service Vulnerabilities## Impact It was found that the fixes to address DoS in React Server Components were incomplete and we found multiple denial of service vulnerabilities still exist in React Server Components. We recommend updating immediately. The vulnerability exists in versions 19.0.0, 19.0.1, 19.0.2, 19.0.3, 19.1.0, 19.1.1, 19.1.2, 19.1.3, 19.1.4, 19.2.0, 19.2.1, 19.2.2, 19.2.3 of: - [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) - [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) - [react-server-dom-turbopack](https://www.npmjs.com/
  • >= 19.2.0-canary-63779030-20250328, < 19.2.4
  • >= 19.1.0-canary-7130d0c6-20241212, < 19.1.5
  • >= 19.0.0, < 19.0.4
GitHub (opens in a new tab)
GHSA-7gmr-mq3h-m5h9HighDenial of Service Vulnerability in React Server Components## Impact It was found that the fix to address [CVE-2025-55184](https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. We recommend updating immediately. The vulnerability exists in versions 19.0.2, 19.1.3, and 19.2.2 of: - [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) - [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) - [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-do
  • >= 19.0.2, < 19.0.3
  • >= 19.1.3, < 19.1.4
  • >= 19.2.2, < 19.2.3
GitHub (opens in a new tab)
GHSA-2m3v-v2m8-q956HighDenial of Service Vulnerability in React Server Components## Impact There is a denial of service vulnerability in React Server Components. React recommends updating immediately. The vulnerability exists in versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of: - [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) - [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) - [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme) These issues are present in the patches published last week. ## Patches Fixes were back ported to ver
  • >= 19.0.0, < 19.0.2
  • >= 19.1.0, < 19.1.3
  • >= 19.2.0, < 19.2.2
GitHub (opens in a new tab)
GHSA-925w-6v3x-g4j4ModerateSource Code Exposure Vulnerability in React Server Components## Impact There is a source code exposure vulnerability in React Server Components. React recommends updating immediately. The vulnerability exists in versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of: - [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) - [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) - [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme) These issues are present in the patches published last week. ## Patches Fixes were back ported to
  • >= 19.0.0, < 19.0.2
  • >= 19.1.0, < 19.1.3
  • >= 19.2.0, < 19.2.2
GitHub (opens in a new tab)
GHSA-fv66-9v8q-g76rCriticalReact Server Components are Vulnerable to RCE### Impact There is an unauthenticated remote code execution vulnerability in React Server Components. We recommend upgrading immediately. The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of: * [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) * [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) * [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme) ### Patches A fix was introduced in versions [19.0.1](https://github.com/facebook/react/releases/tag/v
  • >= 19.0.0, < 19.0.1
  • >= 19.1.0, < 19.1.2
  • >= 19.2.0, < 19.2.1
GitHub (opens in a new tab)
  • GHSA-wx67-qw84-cm4gHigh
    react-server-dom: Denial of Service in Server Functions
    • >= 19.0.0, < 19.0.8
    • >= 19.1.0, < 19.1.9
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 19.0.0, < 19.0.8
    • >= 19.1.0, < 19.1.9
    • >= 19.2.0, < 19.2.8

    ### Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of: - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack ### Patches Fixes were back ported to versions 19.0.8, 19.1.9, and 19.2.8. If you are using any of the above packages please upgrade to any of the fixed versio

    CVE: CVE-2026-44907

  • GHSA-rv78-f8rc-xrxhHigh
    Facebook React has a Denial of Service Vulnerability in React Server Components
    • >= 19.0.0, < 19.0.6
    • >= 19.1.0, < 19.1.7
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 19.0.0, < 19.0.6
    • >= 19.1.0, < 19.1.7
    • >= 19.2.0, < 19.2.6

    ## Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5 of: [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turb

    CVE: CVE-2026-23870

  • GHSA-479c-33wc-g2pgHigh
    React Server Components have a Denial of Service Vulnerability
    • >= 19.0.0, < 19.0.5
    • >= 19.1.0, < 19.1.6
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 19.0.0, < 19.0.5
    • >= 19.1.0, < 19.1.6
    • >= 19.2.0, < 19.2.5

    ## Impact A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack versions 19.0.0, 19.1.0 and 19.2.0. The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints. The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4

    CVE: CVE-2026-23869

  • GHSA-83fc-fqcc-2hmgHigh
    React Server Components have multiple Denial of Service Vulnerabilities
    • >= 19.2.0-canary-63779030-20250328, < 19.2.4
    • >= 19.1.0-canary-7130d0c6-20241212, < 19.1.5
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 19.2.0-canary-63779030-20250328, < 19.2.4
    • >= 19.1.0-canary-7130d0c6-20241212, < 19.1.5
    • >= 19.0.0, < 19.0.4

    ## Impact It was found that the fixes to address DoS in React Server Components were incomplete and we found multiple denial of service vulnerabilities still exist in React Server Components. We recommend updating immediately. The vulnerability exists in versions 19.0.0, 19.0.1, 19.0.2, 19.0.3, 19.1.0, 19.1.1, 19.1.2, 19.1.3, 19.1.4, 19.2.0, 19.2.1, 19.2.2, 19.2.3 of: - [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) - [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) - [react-server-dom-turbopack](https://www.npmjs.com/

    CVE: CVE-2026-23864

  • GHSA-7gmr-mq3h-m5h9High
    Denial of Service Vulnerability in React Server Components
    • >= 19.0.2, < 19.0.3
    • >= 19.1.3, < 19.1.4
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 19.0.2, < 19.0.3
    • >= 19.1.3, < 19.1.4
    • >= 19.2.2, < 19.2.3

    ## Impact It was found that the fix to address [CVE-2025-55184](https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. We recommend updating immediately. The vulnerability exists in versions 19.0.2, 19.1.3, and 19.2.2 of: - [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) - [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) - [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-do

    CVE: CVE-2025-67779

  • GHSA-2m3v-v2m8-q956High
    Denial of Service Vulnerability in React Server Components
    • >= 19.0.0, < 19.0.2
    • >= 19.1.0, < 19.1.3
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 19.0.0, < 19.0.2
    • >= 19.1.0, < 19.1.3
    • >= 19.2.0, < 19.2.2

    ## Impact There is a denial of service vulnerability in React Server Components. React recommends updating immediately. The vulnerability exists in versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of: - [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) - [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) - [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme) These issues are present in the patches published last week. ## Patches Fixes were back ported to ver

    CVE: CVE-2025-55184

  • GHSA-925w-6v3x-g4j4Moderate
    Source Code Exposure Vulnerability in React Server Components
    • >= 19.0.0, < 19.0.2
    • >= 19.1.0, < 19.1.3
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 19.0.0, < 19.0.2
    • >= 19.1.0, < 19.1.3
    • >= 19.2.0, < 19.2.2

    ## Impact There is a source code exposure vulnerability in React Server Components. React recommends updating immediately. The vulnerability exists in versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of: - [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) - [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) - [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme) These issues are present in the patches published last week. ## Patches Fixes were back ported to

    CVE: CVE-2025-55183

  • GHSA-fv66-9v8q-g76rCritical
    React Server Components are Vulnerable to RCE
    • >= 19.0.0, < 19.0.1
    • >= 19.1.0, < 19.1.2
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 19.0.0, < 19.0.1
    • >= 19.1.0, < 19.1.2
    • >= 19.2.0, < 19.2.1

    ### Impact There is an unauthenticated remote code execution vulnerability in React Server Components. We recommend upgrading immediately. The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of: * [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) * [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) * [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme) ### Patches A fix was introduced in versions [19.0.1](https://github.com/facebook/react/releases/tag/v

    CVE: CVE-2025-55182

Showing 1-8 of 8 vulnerabilities