Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence npm

react-server-dom-turbopack

React Server Components bindings for DOM using Turbopack. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly.

npm latest 19.3.0 MIT

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

19.3.0

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

Critical

8 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

8
GHSA-fv66-9v8q-g76r critical CISA KEV

React Server Components are Vulnerable to RCE

Affected range

SEMVER: introduced 19.0.0; fixed 19.0.1SEMVER: introduced 19.1.0; fixed 19.1.2SEMVER: introduced 19.2.0; fixed 19.2.1

Fixed versions: 19.0.1, 19.1.2, 19.2.1

CVE-2025-55182 Source ↗Source ↗
GHSA-wx67-qw84-cm4g high

react-server-dom: Denial of Service in Server Functions

Affected range

SEMVER: introduced 19.0.0; fixed 19.0.8SEMVER: introduced 19.1.0; fixed 19.1.9SEMVER: introduced 19.2.0; fixed 19.2.8

Fixed versions: 19.0.8, 19.1.9, 19.2.8

CVE-2026-44907 Source ↗Source ↗
GHSA-rv78-f8rc-xrxh high

Facebook React has a Denial of Service Vulnerability in React Server Components

Affected range

SEMVER: introduced 19.0.0; fixed 19.0.6SEMVER: introduced 19.1.0; fixed 19.1.7SEMVER: introduced 19.2.0; fixed 19.2.6

Fixed versions: 19.0.6, 19.1.7, 19.2.6

CVE-2026-23870 Source ↗Source ↗
GHSA-479c-33wc-g2pg high

React Server Components have a Denial of Service Vulnerability

Affected range

SEMVER: introduced 19.0.0; fixed 19.0.5SEMVER: introduced 19.1.0; fixed 19.1.6SEMVER: introduced 19.2.0; fixed 19.2.5

Fixed versions: 19.0.5, 19.1.6, 19.2.5

CVE-2026-23869 Source ↗Source ↗
GHSA-83fc-fqcc-2hmg high

React Server Components have multiple Denial of Service Vulnerabilities

Affected range

SEMVER: introduced 19.1.0-canary-7130d0c6-20241212; fixed 19.1.5SEMVER: introduced 19.0.0; fixed 19.0.4SEMVER: introduced 19.2.0-canary-63779030-20250328; fixed 19.2.4

Fixed versions: 19.1.5, 19.0.4, 19.2.4

CVE-2026-23864 Source ↗Source ↗
GHSA-7gmr-mq3h-m5h9 high

Denial of Service Vulnerability in React Server Components

Affected range

SEMVER: introduced 19.0.2; fixed 19.0.3SEMVER: introduced 19.1.3; fixed 19.1.4SEMVER: introduced 19.2.2; fixed 19.2.3

Fixed versions: 19.0.3, 19.1.4, 19.2.3

CVE-2025-67779 Source ↗Source ↗
GHSA-2m3v-v2m8-q956 high

Denial of Service Vulnerability in React Server Components

Affected range

SEMVER: introduced 19.0.0; fixed 19.0.2SEMVER: introduced 19.1.0; fixed 19.1.3SEMVER: introduced 19.2.0; fixed 19.2.2

Fixed versions: 19.0.2, 19.1.3, 19.2.2

CVE-2025-55184 Source ↗Source ↗
GHSA-925w-6v3x-g4j4 moderate

Source Code Exposure Vulnerability in React Server Components

Affected range

SEMVER: introduced 19.0.0; fixed 19.0.2SEMVER: introduced 19.1.0; fixed 19.1.3SEMVER: introduced 19.2.0; fixed 19.2.2

Fixed versions: 19.0.2, 19.1.3, 19.2.2

CVE-2025-55183 Source ↗Source ↗