Vendor
Meta
14 known vulnerabilities in products by Meta, 1 of them actively exploited (CISA KEV).
Key figures
14
Vulnerabilities
1
Actively exploited (KEV)
1
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-55182 | Meta React Server Components Remote Code Execution Vulnerability In CISA KEVRansomwarealso in 2 other products | 10.0 | |
| High | CVE-2025-55184 | Meta React-server-dom-webpack: Deserialization of Untrusted Data | 7.5 | |
| High | CVE-2025-67779 | Meta React-server-dom-parcel: Deserialization of Untrusted Data | 7.5 | |
| Medium | CVE-2025-55183 | Meta React-server-dom-webpack: Information Disclosure | 5.3 | |
| High | CVE-2026-23864 | Meta React-server-dom-webpack: Denial of Service | 7.5 | |
| Critical | CVE-2023-45239 | Meta Tac Plus: Remote Code Execution | 9.8 | |
| Critical | CVE-2022-36934 | Meta WhatsApp: Heap-based Buffer Overflow | 9.8 | |
| High | CVE-2026-23870 | Meta React-server-dom-turbopack: Uncontrolled Resource Consumption | 7.5 | |
| High | CVE-2026-23869 | Meta React-server-dom-turbopack: Denial of Service | 7.5 | |
| High | CVE-2026-44907 | Meta React-server-dom-turbopack: Denial of Service | 7.5 | |
| Critical | CVE-2024-49400 | Meta Tacquito: security vulnerability | 9.8 | |
| High | CVE-2022-27492 | Meta WhatsApp: Integer Underflow (Wrap or Wraparound) | 7.8 | |
| Medium | CVE-2023-5654 | Meta React Developer Tools Extension: Improper Authorization | 6.5 | |
| Low | CVE-2025-30259 | Meta WhatsApp cloud service: security vulnerability | 3.5 |
News
- Credential Harvesting Campaign Exploits React2Shellsans-newsbites-mail,
- LexisNexis breach (FulcrumSec claims React2Shell path)pwn_watch,
Products
| React-server-dom-parcel | 8 | 1 |
| React-server-dom-turbopack | 8 | 1 |
| React-server-dom-webpack | 8 | 1 |