Facebook vulnerabilities
Published CVEs affecting Facebook products: 17 record(s), with severity, exploitation and fixes.
React 5WhatsApp for iOS 4WhatsApp Business for iOS 3WhatsApp Desktop for Mac 2Proxygen 2WhatsApp for Android 2Facebook for WooCommerce 2WhatsApp Desktop 1WhatsApp Business for Android 1WhatsApp for Windows Phone 1WhatsApp for Tizen 1Zstandard 1React-server-dom-parcel 1React-server-dom-turbopack 1React-server-dom-webpack 1WhatsApp Desktop for Windows 1
CVE-2026-49059
Medium · 4.7
CWE-601 May 27, 2026
WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Facebook Facebook for WooCommerce allows Phishing.
This issue affects Facebook for WooCommerce: from n/a through 3.7.0.
CVE-2026-23870
High · 7.5
CWE-400 May 6, 2026
Uncontrolled Resource Consumption in Facebook React-server-dom-parcel
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).
CVE-2026-23866
Medium · 4.3
CWE-940 May 1, 2026
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for…
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.
CVE-2026-23863
Medium · 6.5
CWE-158 May 1, 2026
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709…
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.
CVE-2026-23864
High · 7.5
CWE-400 Jan 26, 2026
Uncontrolled Resource Consumption in Facebook React
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.
CVE-2025-67779
High · 7.5
CWE-502 Dec 11, 2025
Deserialization of Untrusted Data in Facebook React
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
CVE-2025-55184
High · 7.5
Public exploit CWE-502 Dec 11, 2025
Deserialization of Untrusted Data in Facebook React
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
CVE-2025-55183
Medium · 5.3
Dec 11, 2025
An information leak vulnerability exists in specific configurations of React Server…
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
CVE-2025-55182
Critical · 10.0
KEV Urgent · 100 Public exploit Ransomware CWE-502 Dec 3, 2025
Meta React Server Components Remote Code Execution Vulnerability
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
CVE-2025-55181
Medium · 5.3
CWE-834 Dec 2, 2025
Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite…
Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.
CVE-2025-55179
Medium · 5.4
Nov 18, 2025
Incomplete validation of rich response messages in WhatsApp for iOS prior to…
Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen evidence of exploitation in the wild.
CVE-2025-64296
Medium · 5.3
CWE-862 Oct 29, 2025
WordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerability
Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through <= 3.5.7.
CVE-2025-55177
Medium · 5.4
KEV High · 58 Public exploit CWE-863 Aug 29, 2025
Meta Platforms WhatsApp Incorrect Authorization Vulnerability
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
CVE-2023-44487
High · 7.5
KEV Urgent · 73 Public exploit CWE-400 Oct 10, 2023
HTTP/2 Rapid Reset Attack Vulnerability
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2021-24032
Medium · 4.7
CWE-276 Mar 4, 2021
Incorrect Default Permissions in Facebook Zstandard
Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.
CVE-2019-18426
High · 8.2
KEV High · 64 Public exploit CWE-79 Jan 21, 2020
WhatsApp Cross-Site Scripting Vulnerability
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.
CVE-2019-3568
Critical · 9.8
KEV High · 63 CWE-787 May 14, 2019
WhatsApp VOIP Stack Buffer Overflow Vulnerability
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.