// tag

React

Security incidents tagged React. Newest first.

## 3 React incidents in the last year

through Oct 22, 2026

crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmore

show 3 older incidents

May 6highNext.js / React Server Components May 2026 security releasepatched
› Next.js; react-server-dom-webpack/parcel/turbopack patched
Coordinated May 6–7 2026 security release for React Server Components (CVE-2026-23870 DoS) and multiple Next.js advisories spanning middleware/proxy bypass, XSS, SSRF, cache poisoning and DoS. Upgrade Next.js to 15.5.18 or 16.2.6; react-server-dom-* to 19.0.6 / 19.1.7 / 19.2.6. Next.js 13.x/14.x had no planned patches.
open incident →CVE-2026-23870

Apr 8highReact Server Components DoS CVE-2026-23869 (April Next.js advisory)patched
› Next.js App Router / React Server Components patched
April 8 2026 Next.js advisory GHSA-q4gf-8mx6-v5v3 tracks upstream CVE-2026-23869: crafted requests to App Router Server Function endpoints can cause excessive CPU / DoS. Patched in Next.js 15.5.15 and 16.2.3.
open incident →CVE-2026-23869

Feb 24highLexisNexis breach (FulcrumSec claims React2Shell path)patched
› LexisNexis Legal & Professional (legacy systems / React frontend claim) patched
In March 2026 LexisNexis confirmed a breach of legacy servers exposing customer business contact and related data. Threat actor FulcrumSec claimed access via an unpatched React frontend “React2Shell” (CVE-2025-55182) into AWS infrastructure. LexisNexis said the matter was contained and mostly deprecated pre-2020 data.
open incident →CVE-2025-55182