2 spills in 2026 for React
Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.
Past orders
- criticalpatched TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses @tanstack/start-server-core (npm), @tanstack/react-start (npm), @tanstack/solid-start (npm), @tanstack/vue-start (npm) ## Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. ## Cause…
- highpatchedexploited React Native Community CLI OS Command Injection Vulnerability React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments. Added to CISA KEV on 2026-02-05 (federal deadline 2026-02-26).
- criticalpatchedexploited Meta React Server Components Remote Code Execution Vulnerability Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182. Added to CISA KEV on 2025-12-05 (federal deadline 2025-12-12).
Follow React
RSS: /feed.xml?stack=react. JSON: /incidents.json?stack=react. Or add it to your usual for delivery.