VulnSea

Facebook has 9 CVEs on record between 2021 and 2026. 3 were published in the last 90 days. The busiest recent month was December 2025 with 3. The median CVSS is 7.5 (high), with 1 rated critical. 11% have been exploited in the wild — well above the 1% corpus average, so Facebook flaws are worth patching on sight. The dominant weakness classes are CWE-502 (4) and CWE-400 (3). Most affected products: react (4), proxygen (3), react-server-dom-parcel (1).

CVEs per month

Last 12 months, by publish date

111201020304050607080910
Exploited share
11% vs 1% corpus
Median CVSS
7.5
Publish → KEV
—(1)
Last 90 days
3 prev 1

Products

  • react 4
  • proxygen 3
  • react-server-dom-parcel 1
  • zstandard 1
Follow Facebook:RSS feedSave a search →Embed badge ↗
9
Total CVEs
1
Critical
1
CISA KEV
1
Exploited

Worst active — by depth score

Facebook vulnerabilities

CVEs affecting Facebook, newest first. Open any entry for full detail, references, and exploit status.

9 CVEsRSS

CVE-2026-91096High· 7.5
1mo ago

In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before…

In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before…

▾ TwilightFacebook · proxygenEPSS 0.26%via NVD
CVE-2026-91095Medium· 5.3⚖ disputed
1mo ago

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then i…

▾ SunlitFacebook · proxygenEPSS 0.25%via NVD
CVE-2026-84895High· 7.3
1mo ago

In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method

In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release t…

▾ TwilightFacebook · proxygenEPSS 0.19%via NVD
CVE-2026-23870High· 7.5PoC
5mo ago

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following pac…

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following pac…

▾ Midnightfacebook · react-server-dom-parcelEPSS 1.5%via NVD
CVE-2026-23864High· 7.5
9mo ago

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending s…

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending s…

▾ Twilightfacebook · reactEPSS 2.6%via NVD
CVE-2025-67779High· 7.5
10mo ago

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, al…

▾ Twilightfacebook · reactEPSS 20%via NVD
CVE-2025-55184High· 7.5PoC
10mo ago

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopa…

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopa…

▾ Midnightfacebook · reactEPSS 67%via NVD
CVE-2025-55182Critical· 10.0CISA KEVPoC
10mo ago

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-serve…

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-serve…

▾ Hadalfacebook · reactEPSS 100%via NVD
CVE-2021-24032Medium· 4.7
5y ago

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files …

▾ Sunlitfacebook · zstandardEPSS 0.35%via NVD
Facebook vulnerabilities (CVEs) · VulnSea