@cedarjs/api-server (>=1.0.0-canary.12863, <=9.0.0-canary.1784), @cedarjs/api-server-watch (>=6.0.0-canary.2828, <=9.0.0-canary.3124) +39 more potentially affected by unknown CVE via react-server-dom-webpack (>=19.2.1, <=19.2.8)

react-server-dom-webpack NPM version =19.2.1, =1.0.0-canary.12863, =6.0.0-canary.2828, =1.0.0-canary.12863, =5.0.4-next.167, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =3.0.0-canary.13429, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...

@cedarjs/api-server-watch (>=6.0.3-next.227, <=8.0.0-canary.3460), @cedarjs/cli (>=6.0.3-next.227, <=8.0.0-canary.3460) +10 more potentially affected by unknown CVE via react-server-dom-webpack (19.3.0)

react-server-dom-webpack NPM version 19.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @cedarjs/api-server-watch =6.0.3-next.227, =6.0.3-next.227, =6.0.3-next.227, =6.0.3-next.227, =6.0.3-next.227,...

@cedarjs/api-server (>=1.0.0-canary.12863, <=9.0.0-canary.1784), @cedarjs/api-server-watch (>=6.0.0-canary.2828, <=9.0.0-canary.3124) +39 more potentially affected by unknown CVE via react-server-dom-webpack (>=19.2.1, <=19.2.8)

react-server-dom-webpack NPM version =19.2.1, =1.0.0-canary.12863, =6.0.0-canary.2828, =1.0.0-canary.12863, =5.0.4-next.167, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =3.0.0-canary.13429, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...

@cedarjs/api-server (>=1.0.0-canary.12859, <=1.0.0-canary.12861), @cedarjs/cli (>=1.0.0-canary.12859, <=1.0.0-canary.12861) +12 more potentially affected by unknown CVE via react-server-dom-webpack (19.0.1)

react-server-dom-webpack NPM version 19.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @cedarjs/api-server =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859,...

WS-2026-0151

react-server-dom-webpack/-turbopack 19.0.0-19.0.8 and 19.0.0 beta/rc builds, react-server-dom-webpack/-turbopack/-parcel 19.1.0-19.1.9, 19.2.0-19.2.8, 19.3.0 and 19.x canary builds before the fix: the Server Functions reply decoder rescans the whole submitted FormData for referenced form data and...

WS-2026-0170

react-server-dom-webpack/-turbopack 19.0.0-19.0.8 and 19.0.0 beta/rc builds, react-server-dom-webpack/-turbopack/-parcel 19.1.0-19.1.9, 19.2.0-19.2.8, 19.3.0 and 19.x canary builds before the fix: the React Server Components response writer emits typed arrays as views over their whole underlying...

fix-react2shell-next

fix-react2shell-next Un comando per risolvere CVE-2025-66478 React 2 Shell RCE nella tua app Next.js / React RSC. npx fix-react2shell-next Aggiornamenti di versione deterministici secondo gli advisory ufficiali. Cosa fa 1. Scansiona ricorsivamente tutti i file package.json gestisce monorepo 2...

react2shell-scanner

react2shell-scanner Triage scanner for CVE-2025-55182 R...

Exploit for Improper Authorization in Vercel Next.Js

React2Shell Scanner CVE-2025-29927 — Next.js Server Ac...

K000163005: react-server-dom vulnerability CVE-2026-23870

Security Advisory Description A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpac...

NPM: react-server-dom: Denial of Service in Server Functions

NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-turbopack versions = 19.0.0, 19.0.8...

@cedarjs/api-server (>=1.0.0-canary.12863, <=9.0.0-canary.1784), @cedarjs/api-server-watch (>=6.0.0-canary.2828, <=7.0.0-canary.2989) +18 more potentially affected by CVE-2026-44907 via react-server-dom-webpack (>=19.2.1, <=19.2.7)

react-server-dom-webpack NPM version =19.2.1, =1.0.0-canary.12863, =6.0.0-canary.2828, =1.0.0-canary.12863, =5.0.4-next.167, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =3.0.0-canary.13429, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...

NPM: react-server-dom: Denial of Service in Server Functions

NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-parcel versions = 19.1.0, 19.1.9...

@amazeelabs/bridge-waku (>=1.1.9, <=2.0.1), @amazeelabs/executors (>=3.1.12, <=3.1.14) +20 more potentially affected by CVE-2026-44907 via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.9, =3.1.12, =1.4.7, =1.1.3, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859,...

@amazeelabs/bridge-waku (>=1.1.9, <=2.0.1), @amazeelabs/executors (>=3.1.12, <=3.1.14) +20 more potentially affected by CVE-2026-44907 via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.9, =3.1.12, =1.4.7, =1.1.3, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859,...

EUVD-2026-46307

react-server-dom: Denial of Service in Server Functions...

react-server-dom: Denial of Service in Server Functions

Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7,...

@cedarjs/api-server (>=1.0.0-canary.12863, <=9.0.0-canary.1784), @cedarjs/api-server-watch (>=6.0.0-canary.2828, <=7.0.0-canary.2989) +18 more potentially affected by CVE-2026-44907 via react-server-dom-webpack (>=19.2.1, <=19.2.7)

react-server-dom-webpack NPM version =19.2.1, =1.0.0-canary.12863, =6.0.0-canary.2828, =1.0.0-canary.12863, =5.0.4-next.167, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =3.0.0-canary.13429, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...

@cedarjs/api-server (>=1.0.0-canary.12863, <=9.0.0-canary.1784), @cedarjs/api-server-watch (>=6.0.0-canary.2828, <=7.0.0-canary.2989) +21 more potentially affected by CVE-2026-44907 via react-server-dom-webpack (>=19.2.0-canary-39cad7af-20250411, <=19.2.7)

react-server-dom-webpack NPM version =19.2.0-canary-39cad7af-20250411, =1.0.0-canary.12863, =6.0.0-canary.2828, =1.0.0-canary.12863, =5.0.4-next.167, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =3.0.0-canary.13429, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...

@amazeelabs/bridge-waku (>=1.1.9, <=2.0.1), @amazeelabs/executors (>=3.1.12, <=3.1.14) +20 more potentially affected by CVE-2026-44907 via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.9, =3.1.12, =1.4.7, =1.1.3, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859, =1.0.0-canary.12859,...