This Week
Get Alerts ›
cvehawk_ Get Alerts
Software · React / Next.js

React and Next.js Vulnerabilities

The latest security flaws in React, React Server Components and Next.js, which ones attackers are using, and whether your version is affected.

New flaws, 30 days
2
Critical, 8 weeks
1
On CISA's exploited list
1
Latest exploited
5 Dec 2025

Check package.json, or run npm ls next react in your project.

React and Next.js Security in Short

React used to run only in the browser. With React Server Components and Next.js it runs on your server too, so a flaw there can be a server flaw: React2Shell (CVE-2025-55182) let attackers run code on servers through React Server Components and was exploited widely.

Some Next.js advisories are published only on GitHub and npm and never get a CVE, so this page can show fewer than npm audit does. Run that as well.

How to Keep React and Next.js Patched

  • Update next, react, react-dom and any react-server-dom-* packages together, then rebuild and redeploy. Fixing package.json does nothing until the new build is live.
  • Run npm audit (or your package manager's equivalent) in CI, so a known flaw blocks a deploy.
  • If you're on a hosted platform, it may block some attacks, but your app's own copy still needs updating.

The Past Eight Weeks

Any Score 7+ 8+ 9+

2 flaws scored 7+, newest first.

10 Nov 2026 React · Remote code execution React is a JavaScript library for building user interfaces. CVE-2026-126187 9.5

React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.

Patch now · NVD Record

22 Oct 2026 Next.js · Denial of service Next.js is a React framework for building full-stack web applications. CVE-2026-94482 8.2

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.

Patch this week · NVD Record

Rather not patch it yourself?

Bobble Solutions patches, backs up and watches Linux servers and WordPress sites.

Talk to Bobble Solutions