@cedarjs/api-server (>=1.0.0-canary.12863, <=3.0.0-canary.13332), @cedarjs/cli (>=1.0.0-canary.12863, <=3.0.0-canary.13332) +13 more potentially affected by CVE-2025-55184 +1 more via react-server-dom-webpack (>=19.2.0-canary-cee7939b-20250625, <=19.2.3)

react-server-dom-webpack NPM version =19.2.0-canary-cee7939b-20250625, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...

CVE-2026-23864

CVE-2026-23864 affects React Server Components packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The connected advisories describe a denial-of-service condition triggered by specially crafted HTTP requests to Server Function endpoints, potentially causin...

GHSA-7GMR-MQ3H-M5H9 Denial of Service Vulnerability in React Server Components

Impact It was found that the fix to address CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. We recommend updating immediately. The vulnerability exists in versions 19.0.2, 19.1.3, and 19.2.2 of: - react-server-dom-webpac...

Node.js React Server Components Denial of Service (CVE-2025-67779)

Multiple Node.js React Server Components packages are affected by a denial of service vulnerability. The following Node.js packages and versions are affected: - react-server-dom-webpack 19.0.2, 19.1.3, 19.2.2 - react-server-dom-parcel 19.0.2, 19.1.3, 19.2.2 - react-server-dom-turbopack 19.0.2,...

@cedarjs/api-server (>=1.0.0-canary.12863, <=1.0.0-canary.12878), @cedarjs/cli (>=1.0.0-canary.12863, <=2.0.3-next.1) +13 more potentially affected by CVE-2025-55184 via react-server-dom-webpack (>=19.2.0-canary-cee7939b-20250625, <=19.2.1)

react-server-dom-webpack NPM version =19.2.0-canary-cee7939b-20250625, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2025-55183 +1 more via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.0.4, =2.0.3-next.0 an...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2025-55184 via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.0.4, =2.0.3-next.0 an...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2025-55183 via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.0.4, =2.0.3-next.0 an...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2025-55183 +1 more via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.0.4, =2.0.3-next.0 an...

CVE-2025-55184

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafe...

CVE-2025-55183

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically...

Exploit for Deserialization of Untrusted Data in Facebook React

React CVE-2025-55182 Vulnerability Scanner A bash script to s...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2025-55182 via react-server-dom-webpack (19.0.0-rc-6230622a1a-20240610)

react-server-dom-webpack NPM version 19.0.0-rc-6230622a1a-20240610 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @amazeelabs/bridge-waku =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245,...

@redwoodjs/sdk (>=0.0.63-test.2, <=0.0.79), @storybook/experimental-nextjs-rsc (>=0.0.0-pr-31893-sha-392fa9a5, <=0.0.0-pr-31893-sha-f0bf2189) +1 more potentially affected by CVE-2025-55182 via react-server-dom-webpack (19.2.0-canary-39cad7af-20250411)

react-server-dom-webpack NPM version 19.2.0-canary-39cad7af-20250411 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @redwoodjs/sdk =0.0.63-test.2, =0.0.0-pr-31893-sha-392fa9a5, =0.0.79-test.2025050614455...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2025-55182 via react-server-dom-webpack (19.0.0-rc-6230622a1a-20240610)

react-server-dom-webpack NPM version 19.0.0-rc-6230622a1a-20240610 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @amazeelabs/bridge-waku =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245,...

Arbitrary Code Injection

Overview react-server-dom-webpack is a React Server Components bindings for DOM using Webpack. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe deserializatio...

@redwoodjs/sdk (>=0.0.63-test.2, <=0.0.79), @storybook/experimental-nextjs-rsc (>=0.0.0-pr-31893-sha-392fa9a5, <=0.0.0-pr-31893-sha-f0bf2189) +1 more potentially affected by CVE-2025-55182 via react-server-dom-webpack (19.2.0-canary-39cad7af-20250411)

react-server-dom-webpack NPM version 19.2.0-canary-39cad7af-20250411 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @redwoodjs/sdk =0.0.63-test.2, =0.0.0-pr-31893-sha-392fa9a5, =0.0.79-test.2025050614455...

CVE-2025-55182

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes...

CVE-2025-55182

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes...

Node.js React Server Components Unauthenticated Remote Code Execution (CVE-2025-55182)

Multiple Node.js React Server Components packages are affected by an unauthenticated remote code execution vulnerability. The following Node.js packages and versions are affected: - react-server-dom-webpack 19.0, 19.1.0, 19.1.1, 19.2.0 - react-server-dom-parcel 19.0, 19.1.0, 19.1.1, 19.2.0 -...