# Meta vulnerabilities

Source: https://junglewise.ai/threats/vendors/meta  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/meta.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 34 vulnerabilities in Meta: 8 in the last 7 days and 11 in the last 90 days, 4 of them critical and 2 exploited in the wild. The most recent, CVE-2026-121737, was published on 11 November 2026. Nothing in the last four weeks, down from 3 vulnerabilities in the four before. 0 critical against 1. 6 technologies have a page of their own.

## Counts

- Last 7 days: 8
- Last 30 days: 8
- Last 90 days: 11
- All time: 34 (4 critical, 2 exploited in the wild)

## About Meta

Technology and social media company.

## Latest Meta vulnerabilities

- [CVE-2026-121737: Meta proxygen use-after-free in HTTP session handling](https://junglewise.ai/threats/cve-2026-121737-when-a-remote-unauthenticated-http-1-1-client-pipelined-the) (info, published 11 Nov 2026)
- [CVE-2026-119723: HHVM denial of service in request variable parsing](https://junglewise.ai/threats/cve-2026-119723-when-parsing-request-variables-such-as-query-string-and-form) (info, published 11 Nov 2026)
- [CVE-2026-119237: Meta proxygen HTTP/3 denial of service in QPACK handling](https://junglewise.ai/threats/cve-2026-119237-in-proxygen-s-http-3-session-when-a-headers-block-referenced) (info, published 11 Nov 2026)
- [CVE-2026-119236: Meta mvfst QUIC server memory exhaustion in CRYPTO frame handling](https://junglewise.ai/threats/cve-2026-119236-an-mvfst-quic-server-retained-crypto-frame-data-received-at-an) (info, published 11 Nov 2026)
- [CVE-2026-119235: proxygen QPACK decoder unbounded buffering denial of service](https://junglewise.ai/threats/cve-2026-119235-proxygen-s-qpack-decoder-enforced-its-size-limit-on-a-string) (info, published 11 Nov 2026)
- [CVE-2026-119234: mvfst QUIC stream reassembly denial of service](https://junglewise.ai/threats/cve-2026-119234-mvfst-did-not-adequately-merge-or-compact-out-of-order-stream) (info, published 11 Nov 2026)
- [CVE-2026-119233: Meta proxygen HTTP/3 denial of service in frame buffering](https://junglewise.ai/threats/cve-2026-119233-proxygen-s-http-3-codec-buffered-an-incomplete-non-data-frame) (info, published 11 Nov 2026)
- [CVE-2026-126187: React Server Components remote code execution via deserialization](https://junglewise.ai/threats/cve-2026-126187-react-unauthenticated-remote-code-execution-in-react-server) (critical, CVSS 4, published 10 Nov 2026)
- [CVE-2026-39761: Meta Box AIO privilege escalation in unauthenticated access](https://junglewise.ai/threats/cve-2026-39761-unauthenticated-privilege-escalation-in-meta-box-aio-3-7-1) (critical, CVSS 9.8, published 6 Oct 2026)
- [CVE-2026-91096: Meta proxygen use-after-free in stream cleanup](https://junglewise.ai/threats/cve-2026-91096-in-proxygen-from-v2024-10-28-00-until-v2026-09-28-00) (info, published 28 Sep 2026)
- [CVE-2026-91095: Meta proxygen use-after-free in WebTransport stream handling](https://junglewise.ai/threats/cve-2026-91095-in-proxygen-from-v2024-10-28-00-until-v2026-09-28-00-the) (info, published 28 Sep 2026)
- [CVE-2026-66707: Meta Facebook for WooCommerce unauthenticated XSS](https://junglewise.ai/threats/cve-2026-66707-meta-facebook-for-woocommerce-unauthenticated-xss) (high, CVSS 7.1, published 6 Aug 2026)
- [CVE-2026-15248: Meta Box WordPress plugin arbitrary attachment deletion via authorization bypass](https://junglewise.ai/threats/cve-2026-15248-meta-box-wordpress-plugin-arbitrary-attachment-deletion-via) (medium, CVSS 5.5, published 2 Aug 2026)
- [CVE-2026-44907: Meta React denial of service in Server Functions](https://junglewise.ai/threats/cve-2026-44907-meta-react-denial-of-service-in-server-functions) (high, CVSS 7.5, published 21 Jul 2026)
- [CVE-2026-49059: Facebook Facebook for WooCommerce open redirect](https://junglewise.ai/threats/cve-2026-49059-facebook-facebook-for-woocommerce-open-redirect) (medium, CVSS 4.7, published 27 May 2026)
- [Next.js and React denial of service in Server Components](https://junglewise.ai/threats/next-js-and-react-denial-of-service-in-server-components-b02b7bc4) (high, CVSS 7.5, published 11 May 2026)
- [CVE-2026-23866: Meta WhatsApp improper validation in AI rich response messages](https://junglewise.ai/threats/cve-2026-23866-meta-whatsapp-improper-validation-in-ai-rich-response-messages) (medium, CVSS 4.3, published 1 May 2026)
- [CVE-2026-23863: Meta WhatsApp attachment spoofing in Windows Desktop client](https://junglewise.ai/threats/cve-2026-23863-meta-whatsapp-attachment-spoofing-in-windows-desktop-client) (medium, CVSS 6.5, published 1 May 2026)
- [CVE-2026-23869: Meta React Server Components denial of service in Server Functions](https://junglewise.ai/threats/cve-2026-23869-meta-react-server-components-denial-of-service-in-server) (high, CVSS 7.5, published 8 Apr 2026)
- [Next.js HTTP request deserialization denial of service in Server Components](https://junglewise.ai/threats/next-js-http-request-deserialization-denial-of-service-in-server-63dde111) (low, CVSS 3.1, published 28 Jan 2026)
- [CVE-2026-23864: Meta React Server Components denial of service in Server Function endpoints](https://junglewise.ai/threats/cve-2026-23864-meta-react-server-components-denial-of-service-in-server-function) (high, CVSS 7.5, published 26 Jan 2026)
- [CVE-2025-67779: It was found that the fix addressing in React Server Components was incomplete and does not prevent a denial of service…](https://junglewise.ai/threats/cve-2025-67779-react-server-components-denial-of-service-via-incomplete-patch) (high, CVSS 7.5, published 12 Dec 2025)
- [CVE-2025-55184: A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0…](https://junglewise.ai/threats/cve-2025-55184-meta-react-server-components-denial-of-service-via-unsafe) (high, CVSS 7.5, published 11 Dec 2025)
- [CVE-2025-55183: An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1…](https://junglewise.ai/threats/cve-2025-55183-react-server-components-source-code-exposure) (medium, CVSS 5.3, published 11 Dec 2025)
- [React Server Components remote code execution via deserialization](https://junglewise.ai/threats/react-server-components-remote-code-execution-via-deserialization-daaaee75) (low, CVSS 3.1, published 3 Dec 2025)

## Most severe Meta vulnerabilities

- [CVE-2025-55182: React Server Components are Vulnerable to RCE](https://junglewise.ai/threats/cve-2025-55182-meta-react-server-components-remote-code-execution) (critical, exploited in the wild, CVSS 10, published 3 Dec 2025)
- [CVE-2025-55177: Meta WhatsApp incorrect authorization in linked device synchronization](https://junglewise.ai/threats/cve-2025-55177-meta-whatsapp-incorrect-authorization-in-linked-device) (critical, exploited in the wild, CVSS 5.4, published 2 Sep 2025)
- [CVE-2026-39761: Meta Box AIO privilege escalation in unauthenticated access](https://junglewise.ai/threats/cve-2026-39761-unauthenticated-privilege-escalation-in-meta-box-aio-3-7-1) (critical, CVSS 9.8, published 6 Oct 2026)
- [CVE-2026-126187: React Server Components remote code execution via deserialization](https://junglewise.ai/threats/cve-2026-126187-react-unauthenticated-remote-code-execution-in-react-server) (critical, CVSS 4, published 10 Nov 2026)
- [CVE-2025-55184: A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0…](https://junglewise.ai/threats/cve-2025-55184-meta-react-server-components-denial-of-service-via-unsafe) (high, CVSS 7.5, published 11 Dec 2025)
- [CVE-2025-67779: It was found that the fix addressing in React Server Components was incomplete and does not prevent a denial of service…](https://junglewise.ai/threats/cve-2025-67779-react-server-components-denial-of-service-via-incomplete-patch) (high, CVSS 7.5, published 12 Dec 2025)
- [CVE-2026-23864: Meta React Server Components denial of service in Server Function endpoints](https://junglewise.ai/threats/cve-2026-23864-meta-react-server-components-denial-of-service-in-server-function) (high, CVSS 7.5, published 26 Jan 2026)
- [CVE-2026-23869: Meta React Server Components denial of service in Server Functions](https://junglewise.ai/threats/cve-2026-23869-meta-react-server-components-denial-of-service-in-server) (high, CVSS 7.5, published 8 Apr 2026)
- [CVE-2026-44907: Meta React denial of service in Server Functions](https://junglewise.ai/threats/cve-2026-44907-meta-react-denial-of-service-in-server-functions) (high, CVSS 7.5, published 21 Jul 2026)
- [Next.js and React denial of service in Server Components](https://junglewise.ai/threats/next-js-and-react-denial-of-service-in-server-components-b02b7bc4) (high, CVSS 7.5, published 11 May 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 3 vulnerabilities in the four before. 0 critical against 1.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 2 | 0 | 0 |
| 5 Oct 2026 | 1 | 1 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 8 | 1 | 0 |

## Meta technologies

- [Meta React Server Components (Parcel)](https://junglewise.ai/threats/technologies/react-server-components-parcel): 11 vulnerabilities
- [Meta React Server Components (Turbopack)](https://junglewise.ai/threats/technologies/react-server-components-turbopack): 11 vulnerabilities
- [Meta React Server Components (Webpack)](https://junglewise.ai/threats/technologies/react-server-components-webpack): 11 vulnerabilities
- [Meta Proxygen](https://junglewise.ai/threats/technologies/meta-proxygen): 6 vulnerabilities
- [Meta Hermes](https://junglewise.ai/threats/technologies/hermes): 4 vulnerabilities
- [Meta WhatsApp for iOS](https://junglewise.ai/threats/technologies/whatsapp-for-ios): 3 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Meta vulnerabilities", https://junglewise.ai/threats/vendors/meta, 12 November 2026.