@slidev-react/cli (>=0.4.6, <=0.4.14), @slidev-react/node (>=0.4.6, <=0.4.14) potentially affected by CVE-2026-41211 via vite-plus (0.1.11)

vite-plus NPM version 0.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on vite-plus and may be impacted: - @slidev-react/cli =0.4.6, =0.4.6, =0.4.14 Source cves: CVE-2026-41211 Source advisory: OSV:GHSA-33R3-4WHC-44C2...

MAL-2026-2906 Malicious code in swplayer-react-sl (npm)

swplayer-react-sl is a malicious npm package that when imported downloads a C2 dropper from https://coingecko-liard.vercel.app and executes it. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb25be00997a0e21d0d5337b89729fe6c3a99c9364f8a46d4b2e2a828e845f54 The...

Malicious code in react-dom-19 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e6b5a54efd0bd62412ae002a01495b83a035014f59692e4e942aeaf9fd70d0d The package react-dom-19 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2685 Malicious code in react-dom-19 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e6b5a54efd0bd62412ae002a01495b83a035014f59692e4e942aeaf9fd70d0d The package react-dom-19 was found to contain malicious code. Source: ossf-package-analysis...

VulnCheck KEV: CVE-2025-55184

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafe...

Malicious Package

Overview @relxui/react is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-2592 Malicious code in @relxui/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b91a4fd21ef12fb1580ab9240c8b51f39c0ba26d19b683ebcac2d86ed7936e78 The package @relxui/react was found to contain malicious code. Source: ghsa-malware 1a95206a60abfe74a108e76e52361543b36e7d78ff34a1273b5cf4c1bb183d1f...

Malicious code in @relxui/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b91a4fd21ef12fb1580ab9240c8b51f39c0ba26d19b683ebcac2d86ed7936e78 The package @relxui/react was found to contain malicious code. Source: ghsa-malware 1a95206a60abfe74a108e76e52361543b36e7d78ff34a1273b5cf4c1bb183d1f...

MAL-2026-2599 Malicious code in ccn-common-react-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e786ee75b4c32af6bfd2d9129d0a1ded7b507ef1141e019acc9b6ba1dc1da374 The package ccn-common-react-library was found to contain malicious code. Source: ghsa-malware...

Malicious code in mdb-react-sortable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 221ae0ca7ee784d6ab2d9bb463b65dc3d998114b51b3dd7a4f3585ef2b1ed11a The package mdb-react-sortable was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview mdb-react-sortable is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-2606 Malicious code in mdb-react-sortable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 221ae0ca7ee784d6ab2d9bb463b65dc3d998114b51b3dd7a4f3585ef2b1ed11a The package mdb-react-sortable was found to contain malicious code. Source: ghsa-malware...

Denial Of Service

React Server Components is vulnerable to Denial of Service. The vulnerability is due to specially crafted HTTP requests to Server Function endpoints, where the payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — React Server Components RCE | CTF Writeup...

Exploit for Deserialization of Untrusted Data in Facebook React

R2SAE - React2Shell Auto-Exploit A Firefox extension...

Exploit for CVE-2026-23869

⚡ CVE-2026-23869 — React2DoS Unauthenticated Remote Denial-o...

Exploit for CVE-2026-23869

⚡ CVE-2026-23869 — React2DoS Unauthenticated Remote Denial-o...

@vitejs/plugin-rsc has a Denial of Service with React Server Components

Impact @vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.4. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg Patches Upgrade immediately to @vitejs/[email protected] or...

GHSA-V457-WXVJ-P9W9 @vitejs/plugin-rsc has a Denial of Service with React Server Components

Impact @vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.4. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg Patches Upgrade immediately to @vitejs/[email protected] or...

Next.js has a Denial of Service with Server Components

A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this...