Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-pa

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of ser

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19

The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content

A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use exce

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command str

react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launc

React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-t