react-native-0.84.0.tgz: 7 vulnerabilities (highest severity is: 9.8)

[mend-for-github-com]

Vulnerable Library - react-native-0.84.0.tgz

Path to dependency file: /MultipartyNewArchitecture/package.json

Path to vulnerable library: /ArchivingNewArchitecture/node_modules/fast-xml-parser/package.json,/MultipartyNewArchitecture/node_modules/fast-xml-parser/package.json

Vulnerabilities

Vulnerability	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (react-native version)	Remediation Possible**	Reachability
CVE-2025-11953	Critical	9.8	High	3.4%	detected in multiple dependencies	Transitive	0.84.1	✅	Unreachable
CVE-2026-33671	High	7.5	Not Defined		detected in multiple dependencies	Transitive	N/A*	❌
CVE-2026-33036	High	7.5	Not Defined	0.1%	fast-xml-parser-4.5.4.tgz	Transitive	N/A*	❌
CVE-2026-33750	Medium	6.5	Not Defined		brace-expansion-1.1.12.tgz	Transitive	N/A*	❌
CVE-2026-33349	Medium	5.9	Not Defined	0.0%	fast-xml-parser-4.5.4.tgz	Transitive	N/A*	❌
CVE-2026-33672	Medium	5.3	Not Defined		detected in multiple dependencies	Transitive	N/A*	❌
CVE-2026-33532	Medium	4.3	Not Defined		yaml-2.8.2.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2025-11953

Vulnerable Libraries - cli-18.0.0.tgz, cli-server-api-18.0.0.tgz

cli-18.0.0.tgz

React Native CLI

Library home page: https://registry.npmjs.org/@react-native-community/cli/-/cli-18.0.0.tgz

Path to dependency file: /ScreenSharing/package.json

Path to vulnerable library: /ScreenSharing/node_modules/@react-native-community/cli/package.json,/Signaling/node_modules/@react-native-community/cli/package.json,/ArchivingNewArchitecture/node_modules/@react-native-community/cli/package.json,/BasicVideoChatNewArchitecture/node_modules/@react-native-community/cli/package.json,/Multiparty/node_modules/@react-native-community/cli/package.json,/BackgroundBlur/node_modules/@react-native-community/cli/package.json,/MultipartyNewArchitecture/node_modules/@react-native-community/cli/package.json,/BasicVideoChat/node_modules/@react-native-community/cli/package.json,/Archiving/node_modules/@react-native-community/cli/package.json

Dependency Hierarchy:

• react-native-0.84.0.tgz (Root Library)
  • community-cli-plugin-0.84.0.tgz
    • ❌ cli-18.0.0.tgz (Vulnerable Library)

cli-server-api-18.0.0.tgz

Library home page: https://registry.npmjs.org/@react-native-community/cli-server-api/-/cli-server-api-18.0.0.tgz

Path to dependency file: /Signaling/package.json

Path to vulnerable library: /Signaling/node_modules/@react-native-community/cli-server-api/package.json,/Multiparty/node_modules/@react-native-community/cli-server-api/package.json,/ArchivingNewArchitecture/node_modules/@react-native-community/cli-server-api/package.json,/Archiving/node_modules/@react-native-community/cli-server-api/package.json,/MultipartyNewArchitecture/node_modules/@react-native-community/cli-server-api/package.json,/BasicVideoChat/node_modules/@react-native-community/cli-server-api/package.json,/ScreenSharing/node_modules/@react-native-community/cli-server-api/package.json,/BackgroundBlur/node_modules/@react-native-community/cli-server-api/package.json,/BasicVideoChatNewArchitecture/node_modules/@react-native-community/cli-server-api/package.json

Dependency Hierarchy:

• react-native-0.84.0.tgz (Root Library)
  • community-cli-plugin-0.84.0.tgz
    • cli-18.0.0.tgz
      • ❌ cli-server-api-18.0.0.tgz (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-11-03

URL: CVE-2025-11953

Threat Assessment

Exploit Maturity: High

EPSS: 3.4%

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-399j-vxmf-hjvr

Release Date: 2025-11-03

Fix Resolution (@react-native-community/cli): 18.0.1

Direct dependency fix Resolution (react-native): 0.84.1

Fix Resolution (@react-native-community/cli-server-api): 18.0.1

Direct dependency fix Resolution (react-native): 0.84.1

In order to enable automatic remediation, please create workflow rules

CVE-2026-33671

Vulnerable Libraries - picomatch-4.0.3.tgz, picomatch-2.3.1.tgz

picomatch-4.0.3.tgz

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

Library home page: https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz

Path to dependency file: /MultipartyNewArchitecture/package.json

Path to vulnerable library: /MultipartyNewArchitecture/node_modules/tinyglobby/node_modules/picomatch/package.json

Dependency Hierarchy:

• react-native-0.84.0.tgz (Root Library)
  • tinyglobby-0.2.15.tgz
    • ❌ picomatch-4.0.3.tgz (Vulnerable Library)

picomatch-2.3.1.tgz

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

Library home page: https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz

Path to dependency file: /Signaling/package.json

Path to vulnerable library: /Signaling/node_modules/picomatch/package.json,/Archiving/node_modules/picomatch/package.json,/MultipartyNewArchitecture/node_modules/picomatch/package.json,/BackgroundBlur/node_modules/picomatch/package.json,/BasicVideoChatNewArchitecture/node_modules/picomatch/package.json,/ArchivingNewArchitecture/node_modules/picomatch/package.json,/BasicVideoChat/node_modules/picomatch/package.json,/Multiparty/node_modules/picomatch/package.json,/ScreenSharing/node_modules/picomatch/package.json

Dependency Hierarchy:

• react-native-0.84.0.tgz (Root Library)
  • jest-environment-node-29.7.0.tgz
    • jest-util-29.7.0.tgz
      • ❌ picomatch-2.3.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as "+()" and "()", especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to "picomatch" for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to "picomatch". Possible mitigations include disabling extglob support for untrusted patterns by using "noextglob: true", rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers such as "+()" and "()", enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, and applying application-level request throttling and input validation for any endpoint that accepts glob patterns.

Publish Date: 2026-03-26

URL: CVE-2026-33671

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-03-25

Fix Resolution: https://github.com/micromatch/picomatch.git - 3.0.2,https://github.com/micromatch/picomatch.git - 4.0.4,https://github.com/micromatch/picomatch.git - 2.3.2

CVE-2026-33036

Vulnerable Library - fast-xml-parser-4.5.4.tgz

Validate XML, Parse XML, Build XML without C/C++ based libraries

Library home page: https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.5.4.tgz

Path to dependency file: /ArchivingNewArchitecture/package.json

Path to vulnerable library: /ArchivingNewArchitecture/node_modules/fast-xml-parser/package.json,/MultipartyNewArchitecture/node_modules/fast-xml-parser/package.json

Dependency Hierarchy:

• react-native-0.84.0.tgz (Root Library)
  • community-cli-plugin-0.84.0.tgz
    • cli-18.0.0.tgz
      • cli-doctor-18.0.0.tgz
        • cli-platform-apple-18.0.0.tgz
          • ❌ fast-xml-parser-4.5.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like A can force ~147MB of memory allocation and heavy CPU usage, potentially crashing the process—even when developers have configured strict limits. This issue has been fixed in version 5.5.6.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-03-20

URL: CVE-2026-33036

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8gc5-j5rx-235r

Release Date: 2026-03-18

Fix Resolution: https://github.com/NaturalIntelligence/fast-xml-parser.git - v5.5.6

CVE-2026-33750

Vulnerable Library - brace-expansion-1.1.12.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz

Path to dependency file: /BasicVideoChatNewArchitecture/package.json

Path to vulnerable library: /BasicVideoChatNewArchitecture/node_modules/test-exclude/node_modules/brace-expansion/package.json,/ArchivingNewArchitecture/node_modules/test-exclude/node_modules/brace-expansion/package.json,/MultipartyNewArchitecture/node_modules/test-exclude/node_modules/brace-expansion/package.json,/ArchivingNewArchitecture/node_modules/glob/node_modules/brace-expansion/package.json,/MultipartyNewArchitecture/node_modules/glob/node_modules/brace-expansion/package.json,/BasicVideoChatNewArchitecture/node_modules/glob/node_modules/brace-expansion/package.json

Dependency Hierarchy:

• react-native-0.84.0.tgz (Root Library)
  • babel-jest-29.7.0.tgz
    • babel-plugin-istanbul-6.1.1.tgz
      • test-exclude-6.0.0.tgz
        • minimatch-3.1.5.tgz
          • ❌ brace-expansion-1.1.12.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Impact A brace pattern with a zero step value (e.g., "{1..2..0}") causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. The loop in question: https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184 "test()" is one of https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113 The increment is computed as "Math.abs(0) = 0", so the loop variable never advances. On a test machine, the process hangs for about 3.5 seconds and allocates roughly 1.9 GB of memory before throwing a "RangeError". Setting max to any value has no effect because the limit is only checked at the output combination step, not during sequence generation. This affects any application that passes untrusted strings to expand(), or by error sets a step value of "0". That includes tools built on minimatch/glob that resolve patterns from CLI arguments or config files. The input needed is just 10 bytes. Patches Upgrade to versions - 5.0.5+ A step increment of 0 is now sanitized to 1, which matches bash behavior. Workarounds Sanitize strings passed to "expand()" to ensure a step value of "0" is not used.

Publish Date: 2026-03-26

URL: CVE-2026-33750

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f886-m6hf-6m8v

Release Date: 2026-03-26

Fix Resolution: brace-expansion - 5.0.5

CVE-2026-33349

Vulnerable Library - fast-xml-parser-4.5.4.tgz

Validate XML, Parse XML, Build XML without C/C++ based libraries

Library home page: https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.5.4.tgz

Path to dependency file: /ArchivingNewArchitecture/package.json

Path to vulnerable library: /ArchivingNewArchitecture/node_modules/fast-xml-parser/package.json,/MultipartyNewArchitecture/node_modules/fast-xml-parser/package.json

Dependency Hierarchy:

• react-native-0.84.0.tgz (Root Library)
  • community-cli-plugin-0.84.0.tgz
    • cli-18.0.0.tgz
      • cli-doctor-18.0.0.tgz
        • cli-platform-apple-18.0.0.tgz
          • ❌ fast-xml-parser-4.5.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.

Publish Date: 2026-03-24

URL: CVE-2026-33349

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jp2q-39xq-3w4g

Release Date: 2026-03-19

Fix Resolution: fast-xml-parser - 5.5.7

CVE-2026-33672

Vulnerable Libraries - picomatch-2.3.1.tgz, picomatch-4.0.3.tgz

picomatch-2.3.1.tgz

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

Library home page: https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz

Path to dependency file: /Signaling/package.json

Path to vulnerable library: /Signaling/node_modules/picomatch/package.json,/Archiving/node_modules/picomatch/package.json,/MultipartyNewArchitecture/node_modules/picomatch/package.json,/BackgroundBlur/node_modules/picomatch/package.json,/BasicVideoChatNewArchitecture/node_modules/picomatch/package.json,/ArchivingNewArchitecture/node_modules/picomatch/package.json,/BasicVideoChat/node_modules/picomatch/package.json,/Multiparty/node_modules/picomatch/package.json,/ScreenSharing/node_modules/picomatch/package.json

Dependency Hierarchy:

• react-native-0.84.0.tgz (Root Library)
  • jest-environment-node-29.7.0.tgz
    • jest-util-29.7.0.tgz
      • ❌ picomatch-2.3.1.tgz (Vulnerable Library)

picomatch-4.0.3.tgz

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

Library home page: https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz

Path to dependency file: /MultipartyNewArchitecture/package.json

Path to vulnerable library: /MultipartyNewArchitecture/node_modules/tinyglobby/node_modules/picomatch/package.json

Dependency Hierarchy:

• react-native-0.84.0.tgz (Root Library)
  • tinyglobby-0.2.15.tgz
    • ❌ picomatch-4.0.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the "POSIX_REGEX_SOURCE" object. Because the object inherits from "Object.prototype", specially crafted POSIX bracket expressions (e.g., "[[:constructor:]]") can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. All users of affected "picomatch" versions that process untrusted or user-controlled glob patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like "[[:...:]]"; avoiding the use of POSIX bracket expressions if user input is involved; and manually patching the library by modifying "POSIX_REGEX_SOURCE" to use a null prototype.

Publish Date: 2026-03-26

URL: CVE-2026-33672

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-03-25

Fix Resolution: https://github.com/micromatch/picomatch.git - 2.3.2,https://github.com/micromatch/picomatch.git - 4.0.4,https://github.com/micromatch/picomatch.git - 3.0.2

CVE-2026-33532

Vulnerable Library - yaml-2.8.2.tgz

JavaScript parser and stringifier for YAML

Library home page: https://registry.npmjs.org/yaml/-/yaml-2.8.2.tgz

Path to dependency file: /BasicVideoChatNewArchitecture/package.json

Path to vulnerable library: /BasicVideoChatNewArchitecture/node_modules/yaml/package.json,/ArchivingNewArchitecture/node_modules/yaml/package.json,/MultipartyNewArchitecture/node_modules/yaml/package.json

Dependency Hierarchy:

• react-native-0.84.0.tgz (Root Library)
  • community-cli-plugin-0.84.0.tgz
    • cli-18.0.0.tgz
      • cli-doctor-18.0.0.tgz
        • ❌ yaml-2.8.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

"yaml" is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of "yaml" on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a "RangeError: Maximum call stack size exceeded" with a small payload (~2–10 KB). The "RangeError" is not a "YAMLParseError", so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process. Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one "[" and one "]"). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation). Note: the library's "Parser" (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion. All three public parsing APIs are affected: "YAML.parse()", "YAML.parseDocument()", and "YAML.parseAllDocuments()". Versions 1.10.3 and 2.8.3 contain a patch.

Publish Date: 2026-03-26

URL: CVE-2026-33532

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-03-25

Fix Resolution: https://github.com/eemeli/yaml.git - v1.10.3,https://github.com/eemeli/yaml.git - v2.8.3

---

In order to enable automatic remediation for this issue, please create workflow rules