Meta bug bounty programs
meta.com Updated
Meta runs 12 public programs on Sorona and its own site; 12 pay cash, the most up to $300,000 (Meta Bug Bounty). It also owns Facebook, which runs one more program.
- Top reward
- $300,000
- Self-hosted
- Programs
- 13
- 13 pay cash
- Targets in scope
- 128
- 6 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
12 programs Meta runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Meta Bug Bounty
Self-hosted · The company-wide program. Pays up to $300,000.
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
Meta Bug Bounty
Self-hosted · Bug bounty |
$300,000 | – | – | – | Open |
|
Hermes
Sorona · Bug bounty |
Not published | Partial | – | – | Open |
|
Watchman
Sorona · Bug bounty |
Not published | Partial | – | – | Open |
|
below
Sorona · Bug bounty |
Not published | Partial | – | – | Open |
|
Zstandard
Sorona · Bug bounty |
Not published | Partial | – | – | Open |
|
Buck2
Sorona · Bug bounty |
Not published | Partial | – | – | Open |
|
Proxygen
Sorona · Bug bounty |
Not published | Partial | – | – | Open |
|
Velox
Sorona · Bug bounty |
Not published | Partial | – | – | Open |
|
Folly
Sorona · Bug bounty |
Not published | Partial | – | – | Open |
|
mvfst
Sorona · Bug bounty |
Not published | Partial | – | – | Open |
|
fizz
Sorona · Bug bounty |
Not published | Partial | – | – | Open |
|
CacheLib
Sorona · Bug bounty |
Not published | Partial | – | – | Open |
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
-
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Meta owns
1 company with 1 program of its own. Each has its own scope and rules: report to the one that owns the asset.
What is in scope
128 targets across all 13 programs, each listed once with the programs that cover it. 90 excluded.
-
Builtins and the standard library: String, Array, JSON, Proxy, the Intl support and the regular-expression engine
Products and areas
Covered by Hermes
-
Certificate handling and chain verification, along with the certificate selection and verification interfaces an embedder plugs into
Products and areas
Covered by fizz
-
Compaction, admission policies and the background workers the engine runs on its own schedule
Products and areas
Covered by CacheLib
-
Concurrency primitives: futures, executors, Synchronized, hazard pointers and the lock-free queues
Products and areas
Covered by Folly
-
Configuration handling, above all the project-supplied .watchmanconfig that arrives with any repository a developer clones
Products and areas
Covered by Watchman
-
Connection ID management, retry, stateless reset, address validation and the anti-amplification limits
Products and areas
Covered by mvfst
-
Content-encoding handling and the compression helpers, plus the sample servers and utilities in the repository
Products and areas
Covered by Proxygen
-
Credential and token handling for remote-execution and cache backends, and whatever reaches logs, build outputs and the daemon's own state
Products and areas
Covered by Buck2
-
Datagram support, the transport hooks an HTTP/3 layer such as Proxygen's builds on, and the sample servers and tooling in the repository
Products and areas
Covered by mvfst
-
Dependency and toolchain resolution, including download paths, artifact verification and how an internal name is told apart from an external one
Products and areas
Covered by Buck2
-
Dictionary support on both sides, covering the COVER and fastCover trainers, dictionary loading through the API, and frames that reference a dictionary by ID
Products and areas
Covered by Zstandard
-
Early data and session resumption, replay behaviour included, plus the boundary between mvfst and the fizz-supplied cryptography beneath it
Products and areas
Covered by mvfst
-
Filesystem handling across the build root: input materialisation, output paths, symlinks and the temporary directories actions run in
Products and areas
Covered by Buck2
-
Flow control, stream limits, loss recovery and the congestion controllers the repository ships
Products and areas
Covered by mvfst
-
Frame parsing and processing across the whole frame set, STREAM, ACK, CRYPTO, NEW_CONNECTION_ID and PATH_CHALLENGE among them, including transitions a peer forces out of order
Products and areas
Covered by mvfst
-
Handshake message parsing and construction: ClientHello, extensions, key shares, certificate messages and everything else a peer sends before authentication completes
Products and areas
Covered by fizz
-
IOBuf and IOBufQueue, the buffer layer every Meta network stack moves bytes through, along with the cursors and codec wrappers in folly::io
Products and areas
Covered by Folly
-
Memory management across DRAM and flash, the memory pools, and the rebalancing and pool-resizing strategies
Products and areas
Covered by CacheLib
-
Memory management: the pool hierarchy, the arbitrator, the allocators, and the accounting meant to stop one query starving another
Products and areas
Covered by Velox
-
Memory, allocator and arithmetic helpers, including the size and capacity computations that later feed an allocation or a copy
Products and areas
Covered by Folly
-
Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and CacheLib is covered whichever of the two you resolve it to, since the repository moved from the incubator org to the main one and both are eligible. The row sets no severity cap and Meta publishes no payout guideline covering open source
Products and areas
Covered by CacheLib
-
Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebook/buck2 sits under the first, so the repository is in scope in full. The row sets no severity cap and Meta publishes no payout guideline covering open source
Products and areas
Covered by Buck2
-
Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebook/folly sits under the first, so the repository is in scope in full. The row sets no severity cap and Meta publishes no payout guideline covering open source
Products and areas
Covered by Folly
-
Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebook/hermes sits under the first, so the repository is in scope in full. It carries no SECURITY.md of its own and inherits the facebook/.github one, which names the same program. The row sets no severity cap and Meta publishes no payout guideline covering open source
Products and areas
Covered by Hermes
-
Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebook/mvfst sits under the first, so the repository is in scope in full. The row sets no severity cap and Meta publishes no payout guideline covering open source
Products and areas
Covered by mvfst
-
Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebook/proxygen sits under the first, so the repository is in scope in full. The row sets no severity cap and Meta publishes no payout guideline covering open source
Products and areas
Covered by Proxygen
-
Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and facebookincubator/below sits under the second, so the repository is in scope in full. The row sets no severity cap and Meta publishes no payout guideline covering open source
Products and areas
Covered by below
-
Meta declares its open-source scope as GitHub organisation prefixes. The scope table's Open source row lists https://github.com/facebook/ and https://github.com/facebookincubator/ as eligible code repos, and fizz is eligible under the second, facebookincubator/fizz. The row sets no severity cap and Meta publishes no payout guideline covering open source
Products and areas
Covered by fizz
-
Meta's scope table names https://github.com/facebook/ as an eligible code-repo prefix, so the whole of facebook/watchman is in scope, every component and every release. Meta determines severity itself and publishes no ceiling for an open-source target.
Products and areas
Covered by Watchman
-
Meta's scope table names https://github.com/facebook/ as an eligible code-repo prefix, so the whole of facebook/zstd is in scope, and zstd's own SECURITY.md points at the same program. Meta determines severity itself and publishes no ceiling for an open-source target.
Products and areas
Covered by Zstandard
-
Meta's scope table names https://github.com/facebookincubator/ as an eligible code-repo prefix, so the whole of facebookincubator/velox is in scope, every component and every release. Meta determines severity itself and publishes no ceiling for an open-source target.
Products and areas
Covered by Velox
-
Navy, the flash-cache engine, covering the block and big-hash engines, region management, the index and the record format read back off a device
Products and areas
Covered by CacheLib
-
Packet handling: long and short header decoding, version negotiation, coalesced packets, packet-number decoding and header protection
Products and areas
Covered by mvfst
-
Parsing and formatting: folly::dynamic, the JSON and JSON-pointer code, URI parsing, the to<> conversions and the format library
Products and areas
Covered by Folly
-
Serialization and shuffle: the Presto, CompactRow and UnsafeRow serialisers together with the exchange client that pulls pages from other workers over the network
Products and areas
Covered by Velox
-
Serialization of cached items and of on-disk metadata, plus the persistence and warm-roll paths that reload state a previous process wrote
Products and areas
Covered by CacheLib
-
Starlark evaluation: BUCK files, .bzl rule definitions, macros and the prelude, all of which arrive with any repository a developer checks out
Products and areas
Covered by Buck2
-
State on disk: the state directory, log files, cookie files, trigger persistence and saved state, with their names, permissions and symlink behaviour
Products and areas
Covered by Watchman
-
The action cache and the content-addressable store: digests, cache keys, uploads, downloads and the integrity checking around them
Products and areas
Covered by Buck2
-
The action execution layer, covering local execution, the sandbox and isolation model, and the remote-execution client that talks to build workers
Products and areas
Covered by Buck2
-
The API fizz presents upward to Proxygen, wangle and mvfst, where a handshake outcome is reported to a transport that then trusts it
Products and areas
Covered by fizz
-
The async and networking layer in folly::io::async: the event base, the socket and SSL socket wrappers, and the timeout machinery
Products and areas
Covered by Folly
-
The BSER binary protocol and the JSON protocol, encoding and decoding alike, together with the Python and Rust client libraries and the CLI shipped in the same repository
Products and areas
Covered by Watchman
-
The buck2 client and the daemon behind it, including the control channel between them and the privilege boundary separating the daemon from the user who invoked it
Products and areas
Covered by Buck2
-
The build, test and release tooling in the repository, the place a supply-chain finding against a library this widely redistributed would live
Products and areas
Covered by Zstandard
-
The bytecode format and its loader, covering header and version checks, table validation and how a .hbc file is mapped in
Products and areas
Covered by Hermes
-
The bytecode interpreter and the object model beneath it: property storage, hidden classes and the inline caches
Products and areas
Covered by Hermes
-
The C++ API a service embeds against: key handling, lookup, chained and nested items, and the item-handle contract
Products and areas
Covered by CacheLib
-
The cache allocator in full: slab classes, the item layout, allocation, eviction and the reference counting that governs item lifetime
Products and areas
Covered by CacheLib
-
The client side: the HTTP client, connection pooling and upstream session handling
Products and areas
Covered by Proxygen
-
The codecs the library ships, on both the request and the response side: HTTP/1.1, HTTP/2 with HPACK, and HTTP/3 with QPACK
Products and areas
Covered by Proxygen
-
The compression library: the match finders at every level, the long-distance matcher, the row-hash and binary-tree strategies, and the multithreaded compressor
Products and areas
Covered by Zstandard
-
The container and string types: fbstring, the F14 maps and sets, small_vector, the sorted-vector types and Range/StringPiece
Products and areas
Covered by Folly
-
The contributed formats and wrappers shipped in the repository, including the seekable format, pzstd, the zlib compatibility wrapper, and the freestanding and Linux-kernel builds the kernel's own zstd is generated from
Products and areas
Covered by Zstandard
-
The cryptographic layer the library ships: its OpenSSL bindings, exporters, AEADs and hash implementations
Products and areas
Covered by fizz
-
The daemon: startup and auto-spawn, the Unix domain socket and Windows named pipe it listens on, socket ownership and permissions, and the identity checks between a client and the server it reaches
Products and areas
Covered by Watchman
-
The debugger and the inspector protocol implementation, plus the hermesc compiler and the standalone VM the repository ships
Products and areas
Covered by Hermes
-
The decompression library: frame and block parsing, the Huffman and FSE entropy decoders, the sequence and match-copy loops, and the streaming and single-shot APIs wrapped around them
Products and areas
Covered by Zstandard
-
The dwio connector stack that reads and writes Parquet, ORC and DWRF, from footer and metadata parsing down to the column decoders and compression codecs
Products and areas
Covered by Velox
-
The execution operators: hash and merge joins, aggregations, window functions, sorting, and the spill-to-disk paths behind them
Products and areas
Covered by Velox
-
The expression evaluation engine, covering compilation, constant folding, peeling and the vectorised function call path
Products and areas
Covered by Velox
-
The garbage collector, Hades included, with rooting, write barriers and object lifetime
Products and areas
Covered by Hermes
-
The hashing, portability and cryptographic helper code the library ships
Products and areas
Covered by Folly
-
The JavaScript front end, meaning the lexer, the parser, semantic validation and the ahead-of-time compiler that emits Hermes bytecode
Products and areas
Covered by Hermes
-
The JSI boundary, host objects and host functions, where JavaScript crosses into native code the embedding app trusts
Products and areas
Covered by Hermes
-
The key schedule and key derivation, session tickets, PSK binders, early data and its replay handling
Products and areas
Covered by fizz
-
The legacy-format decoders, which still accept frames written by every zstd version back to v0.1
Products and areas
Covered by Zstandard
-
The proxy and forwarding paths, header rewriting, and the boundary Proxygen occupies between an upstream and a downstream peer
Products and areas
Covered by Proxygen
-
The Python bindings, the runner binaries and the build tooling in the repository, all covered by the same prefix
Products and areas
Covered by Velox
-
The query engine: expression terms, glob and path matching, and the since and clock-spec machinery clients rely on for correctness
Products and areas
Covered by Watchman
-
The QUIC transport in full, client and server: connection setup, the connection and stream state machines, and the API the library presents to an application
Products and areas
Covered by mvfst
-
The record layer: framing, length handling, padding, encryption and decryption
Products and areas
Covered by fizz
-
The recording daemon in full: the collection loop, the cgroup2 and procfs readers behind it, and everything the process does while running as root
Products and areas
Covered by below
-
The replay side, meaning the record, live, replay, snapshot and dump subcommands and the code that reads back a store an earlier privileged run produced
Products and areas
Covered by below
-
The Rust crates that make up the repository, unsafe blocks and C bindings included
Products and areas
Covered by below
-
The server side: the HTTP server and its acceptors, connection handling, TLS termination through fizz, and the filter chain a request handler sits behind
Products and areas
Covered by Proxygen
-
The session and transaction layer, covering the stream state machines, flow control, concurrency limits, priorities and connection reuse
Products and areas
Covered by Proxygen
-
The SQL function libraries for both the Presto and the Spark dialect, where string, date, JSON, URL and regular-expression functions touch user values directly
Products and areas
Covered by Velox
-
The store under /var/log/below: the directories and files it creates, the ownership and permission modes it sets on them, and the compressed history format it writes
Products and areas
Covered by below
-
The systemd unit the project ships and any interface it leaves open between an unprivileged account and the long-lived root process
Products and areas
Covered by below
-
The terminal UI, the dump subcommand's output formatters, and the configuration file the daemon and CLI both read
Products and areas
Covered by below
-
The TLS 1.3 state machine on both sides, client and server, from the first flight through to post-handshake messages
Products and areas
Covered by fizz
-
The vector library and type system: the flat, dictionary, constant and lazy layouts, decoding between them, and the buffer arithmetic every operator is built on
Products and areas
Covered by Velox
-
The watcher backends for each platform, meaning inotify, FSEvents, kqueue, the Windows portability layer and the EdenFS integration
Products and areas
Covered by Watchman
-
The zstd command line tool and its helpers: file handling, output permissions, temporary files, --patch-from, --train and argument parsing
Products and areas
Covered by Zstandard
-
Triggers and subscriptions, which let a watched project cause the daemon to spawn commands on the developer's behalf
Products and areas
Covered by Watchman
-
Upgrade paths: WebSocket, CONNECT and extended CONNECT, along with the transport binding onto QUIC streams for HTTP/3
Products and areas
Covered by Proxygen
No target matches. Try part of a host name, such as the company name.
Out of scope 90
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
*.facebook.com
Meta Bug Bounty
-
accountkit.com
Meta Bug Bounty
-
alpha.whatsapp.com
Meta Bug Bounty
-
apps.facebook.com
Meta Bug Bounty
-
blog.whatsapp.com
Meta Bug Bounty
-
communityforums.atmeta.com
Meta Bug Bounty
-
daytum.com
Meta Bug Bounty
-
document.domain
Meta Bug Bounty
-
drop.io
Meta Bug Bounty
-
face.com
Meta Bug Bounty
-
facebook.com
Meta Bug Bounty
-
fb.com
Meta Bug Bounty
-
fb.me
Meta Bug Bounty
-
fbrell.com
Meta Bug Bounty
-
fbsbx.com
Meta Bug Bounty
-
freebasics.com
Meta Bug Bounty
-
friendfeed.com
Meta Bug Bounty
-
getsupernatural.com
Meta Bug Bounty
-
instagram.com
Meta Bug Bounty
-
investor.fb.com
Meta Bug Bounty
-
m.facebook.com
Meta Bug Bounty
-
media.whatsapp.com
Meta Bug Bounty
-
messenger.com
Meta Bug Bounty
-
meta.ai
Meta Bug Bounty
-
meta.com
Meta Bug Bounty
-
monoidics.com
Meta Bug Bounty
-
muse.ai
Meta Bug Bounty
-
oculus.com
Meta Bug Bounty
-
opencompute.org
Meta Bug Bounty
-
page.ly
Meta Bug Bounty
-
ray-ban.com
Meta Bug Bounty
-
spaceport.io
Meta Bug Bounty
-
thefacebook.com
Meta Bug Bounty
-
threads.com
Meta Bug Bounty
-
translate.whatsapp.com
Meta Bug Bounty
-
web.whatsapp.com
Meta Bug Bounty
-
whatsapp.net
Meta Bug Bounty
-
workplace.com
Meta Bug Bounty
-
mapillary.com
Meta Bug Bounty
-
https://github.com/facebook
Meta Bug Bounty
-
https://github.com/facebookarchive
Meta Bug Bounty
-
https://github.com/facebookincubator
Meta Bug Bounty
-
Application-side API misuse: documented preconditions violated, return values ignored, or a Folly type handed state the caller already invalidated
Folly
-
Attacks that require root, or an account that already holds the privilege being claimed, which sit inside the trust boundary rather than across it
Watchman
-
Attacks that start from root, which sits inside the trust boundary this project defends
below
-
Awards blocked by sanctions screening, since Meta confirms every bounty is permitted under US trade sanctions and economic restrictions
Velox Watchman Zstandard
-
Awards that sanctions screening blocks: Meta verifies every bounty is permitted under US trade sanctions and economic restrictions
below Buck2 Folly CacheLib fizz mvfst Hermes Proxygen
-
Behaviour RFC 9000 or RFC 9001 mandates that you disagree with, which is a specification complaint rather than an implementation vulnerability
mvfst
-
Bugs in an application that embeds Hermes where the defect is that application's own JavaScript or native code
Hermes
-
Bugs that actually live in a project that embeds zstd rather than in zstd itself, which belong with that project's own program
Zstandard
-
Build correctness, incrementality and cache-invalidation bugs with no security consequence
Buck2
-
Build-configuration and portability problems, compiler warnings, and sanitizer output submitted with no reproducing input
Folly
-
Cache-hit-rate, eviction-policy and throughput complaints, which are tuning matters rather than vulnerabilities
CacheLib
-
Compression ratio, throughput and interoperability complaints that carry no security consequence
Zstandard
-
Crashes with no demonstrated memory-safety or control-flow consequence, a bare assertion failure or an out-of-memory abort among them
Hermes
-
Cryptographic defects that belong to fizz, which supplies mvfst's TLS 1.3 layer and has its own entry under the same program
mvfst
-
Defects in a distribution's packaging of below, its unit files or install paths, rather than in the project's own code
below
-
Defects in a toolchain buck2 invokes, a compiler, a linker or a packaging tool, which belong to that tool's own project
Buck2
-
Defects in Presto, Spark or Gluten themselves rather than in the Velox execution layer they embed
Velox
-
Defects in the service that embeds CacheLib rather than in the caching engine itself
CacheLib
-
Defects in the tools that drive Watchman, meaning Jest, Metro, Buck or Sapling, rather than in the daemon itself
Watchman
-
Defects in the transports that consume fizz, Proxygen, wangle and mvfst, each of which is its own repository with its own entry under the same program
fizz
-
Defects that actually live in Folly, fizz or mvfst rather than in Proxygen's own code. Each is a separate repository with its own entry under the same program
Proxygen
-
Defects that turn out to live in a downstream consumer, Proxygen, mvfst, fizz, Velox or CacheLib, each of which is its own repository with its own entry under the same program
Folly
-
Duplicates, since only the first reporter of an issue is paid
Zstandard
-
Duplicates. Meta pays the first reporter only
below Folly fizz Hermes CacheLib Buck2 Proxygen mvfst
-
Extremely low-risk issues, which Meta states may not qualify for a bounty at all
CacheLib Watchman below Buck2 mvfst Hermes Proxygen fizz Folly Velox
-
Extremely low-risk issues, which Meta states outright may not qualify for a bounty at all
Zstandard
-
Facebook for Blackberry
Meta Bug Bounty
-
Facebook for Windows
Meta Bug Bounty
-
Findings with no demonstrated impact on Meta users or systems, and duplicates, since only the first reporter is paid
Watchman Velox
-
Findings with no demonstrated impact on Meta users or systems, since that is what Meta scores a report on
fizz mvfst Hermes below Proxygen CacheLib Buck2
-
Findings with no demonstrated impact on Meta users or systems, which Meta scores low even for a library this central
Folly
-
Findings with no demonstrated impact on Meta users or systems, which Meta scores low however widely deployed the library is
Zstandard
-
Issues that need the attacker to already hold code execution as the cache process, which sits inside the trust boundary
CacheLib
-
Issues that require the attacker to already control the local machine or the build of the library, which sit inside the trust boundary rather than across it
Zstandard
-
Load-generation results where the attack costs the attacker as much as the defender, which is volume rather than a vulnerability
Proxygen
-
Objections to fizz's default cipher-suite, group or protocol-version selection, which are configuration choices rather than implementation defects
fizz
-
OpenSSL itself, which fizz links against and which belongs to another project
fizz
-
Performance regressions and out-of-memory conditions under legitimate load on an under-provisioned worker
Velox
-
React Native itself, for that reason. It now lives in the react/ org, so a defect there is unpayable under this program however directly it touches Hermes
Hermes
-
Repositories outside the two eligible code-repo prefixes; the same scope row names https://github.com/facebookarchive/ as ineligible
Watchman Velox
-
Repositories outside the two eligible code-repo prefixes; the same scope row names https://github.com/facebookarchive/ as ineligible, and archiving a Meta repo removes it from scope
Zstandard
-
Repositories outside those two prefixes. The same scope row names https://github.com/facebookarchive/ as ineligible, and neither facebookresearch/ nor the react/ org that React and React Native moved into appears on the eligible list
Proxygen CacheLib fizz Buck2 mvfst Hermes below Folly
-
Resource consumption on a machine watching a very large tree, absent a crafted input that makes the cost disproportionate
Watchman
-
Specification complaints: behaviour that is unpleasant and is also what the relevant HTTP RFC mandates
Proxygen
-
The fact that a build definition runs code by design. A report has to show a trust boundary being crossed
Buck2
-
Third-party libraries Velox builds against, which belong to their own maintainers
Velox
-
Volumetric flooding that costs the attacker roughly what it costs the defender
mvfst
-
Wrong query results with no security consequence. A correctness bug in a SQL function is a bug report rather than a vulnerability.
Velox
Recent changes
Reward and scope changes across every Meta program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Meta products, from the NVD.
-
CVE-2026-23870 High
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.
-
CVE-2026-23864 High
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vul
-
CVE-2025-67779 High
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may pr
-
CVE-2025-55184 High
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite l
-
CVE-2025-55183 Medium
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Serve
-
CVE-2025-55182 Critical
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
-
CVE-2025-55181 Medium
Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.
-
CVE-2025-27591 Medium
A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
About this page
This page gathers every public program listed under meta.com and the companies Meta owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Meta.
Something wrong or missing? Report a correction.