Facebook

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Facebook product.

RSS Feeds for Facebook security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Facebook products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Facebook Sorted by Most Security Vulnerabilities since 2018

Facebook Thrift10 vulnerabilities

Facebook Proxygen7 vulnerabilities

Facebook3 vulnerabilities

Facebook For Woocommerce3 vulnerabilities

Facebook React Dev Utils2 vulnerabilities

Facebook Meta Spark Studio1 vulnerability

Facebook Below1 vulnerability

Facebook Messenger1 vulnerability

By the Year

In 2026 there have been 0 vulnerabilities in Facebook. Last year, in 2025 Facebook had 5 security vulnerabilities published. Right now, Facebook is on track to have less security vulnerabilities in 2026 than it did last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	5	5.35
2024	2	7.80
2023	16	8.50
2022	8	8.69
2021	25	8.40
2020	11	8.06
2019	29	8.74
2018	10	8.18

It may take a day or so for new Facebook vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Facebook Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-55181	Dec 02, 2025	Unbounded Memory Growth in Proxygen via Infinite Loop on Large HTTP Body Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.	Proxygen
CVE-2025-55179	Nov 18, 2025	WhatsApp iOS/Mac before v2.25.23.83: media URL validation flaw (CVE-2025-55179) Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another users device. We have not seen evidence of exploitation in the wild.
CVE-2025-64296	Oct 29, 2025	Missing Auth in Facebook for WooCommerce 3.5.7 Missing Authorization vulnerability in Facebook Facebook for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through 3.5.7.	Facebook For Woocommerce
CVE-2025-55177	Aug 29, 2025	WhatsApp iOS/Mac 2.25.21.* Incomplete Auth for Linked Device Sync Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a targets device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
CVE-2025-27591	Mar 11, 2025	Privilege Escalation via world-writable /var/log/below (<v0.9.0) A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.	Below
CVE-2024-45773	Sep 27, 2024	AoF in Facebook Thrift <2024.09.09.00 via upgradeToRocket A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00.	Thrift
CVE-2024-23347	Jan 16, 2024	Meta Spark Studio execs arbitrary code via package.json scripts (CVE-2024-23347) Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application.	Meta Spark Studio
CVE-2023-49062	Nov 28, 2023	Katran Kernel IP Header Disclosure via Uninitialized Identification Field Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP (v4) Too Big packet generation. After a bpf_xdp_adjust_head call, Katran code didnt initialize the Identification field for the IPv4 header, resulting in writing content of kernel memory in that field of IP header. The issue affected all Katran versions prior to commit 6a03106ac1eab39d0303662963589ecb2374c97f	Katran
CVE-2023-5654	Oct 19, 2023	React DevTools Extension Arbitrary URL Fetch via Unvalidated MsgListener The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URLs via the victim's browser.	React Devtools
CVE-2023-44487	Oct 10, 2023	HTTP/2 DoS via Stream Reset in nginx The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.	Proxygen
CVE-2023-45239	Oct 06, 2023	RCE via shell injection in tac_plus pre/post auth commands A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent to tac_plus to inject shell commands and gain remote code execution on the tac_plus server.	Tac Plus
CVE-2023-23759	May 18, 2023	fizz TLS <= v2023.01.30.00: Remote DoS via Cipher Change There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client supported cipher advertisement changing between the original ClientHello and the second ClientHello, crashing the process (impact is limited to denial of service).	Fizz
CVE-2023-23556	May 18, 2023	Hermes BigInt OOB Write RCE An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound write. Note that this bug is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.	Hermes
CVE-2023-24832	May 18, 2023	Hermes Runtime NPE Crash via EnableHermesInternal in React Native A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.	Hermes
CVE-2023-24833	May 18, 2023	Hermes JS Engine UAF Leak in BigIntPrimitive Addition A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw data from Hermes VMs heap. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.	Hermes
CVE-2023-23557	May 18, 2023	Hermes JS Engine Type Confusion A/C via Object Property Copy An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.	Hermes
CVE-2023-25933	May 18, 2023	Hermes TypedArray VC Enables Code Exec via Untrusted JS A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to execute arbitrary code via untrusted JavaScript. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.	Hermes
CVE-2023-28081	May 18, 2023	Hermes JS Engine Use-After-Free via Bytecode Optimizer A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary code execution via a carefully crafted payload. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.	Hermes
CVE-2023-28753	May 18, 2023	INT Overflow Heap Corruption in netconsd<0.2 netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function. A malicious individual could leverage this overflow to create heap memory corruption with attacker controlled data.	Netconsd
CVE-2023-30470	May 18, 2023	Hermes VM Use-After-Free RCE via Bytecode Generation A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f737ebb9d9810633502f65ed462b819c09 could have been used by an attacker to achieve remote code execution. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.	Hermes
CVE-2022-36937	May 10, 2023	HHVM TLS1.0 Use in Stream Extension (4.172.0) HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3. Applications that call stream_socket_server or stream_socket_client functions with a URL starting with tls:// are affected.	Hhvm
CVE-2023-30792	Apr 29, 2023	XSS: Anchor hrefs in Lexical <0.10.0 allow JavaScript URLs Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources.	Lexical
CVE-2022-4899	Mar 31, 2023	zstd v1.4.10 CLI Buffer Overrun via Empty Argument A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.	Zstandard
CVE-2022-36938	Nov 11, 2022	Redex DexLoader OOB RCE via Malformed APK DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially allowing remote code execution during processing of a 3rd party Android APK file.	Redex
CVE-2022-40138	Oct 11, 2022	Hermes bytecode OOB via int conversion for arbitrary code exec An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.	Hermes
CVE-2022-35289	Oct 11, 2022	Hermes JS Engine Write-What-Where via Integer Overflow (CVE-2022-35289) A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.	Hermes
CVE-2022-32234	Oct 11, 2022	Hermes OOB write: potential arbitrary code via crafted JS An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.	Hermes
CVE-2022-27810	Oct 06, 2022	Infinite Recursion in Hermes (0.11) devmode only It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was only possible to trigger in dev-mode (when asserts were enabled). This issue affects Hermes versions prior to v0.12.0.	Hermes
CVE-2020-20094	Mar 23, 2022	Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages	Instagram
CVE-2020-20093	Mar 23, 2022	The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages.	Messenger
CVE-2021-24044	Jan 15, 2022	By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error, with a low chance of RCE. This issue affects Hermes versions prior to v0.10.0.	Hermes
CVE-2021-24045	Dec 13, 2021	A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0 A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.	Hermes
CVE-2019-3556	Oct 26, 2021	HHVM supports the use of an "admin" server which accepts administrative requests over HTTP HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to output cached regular expressions from the current execution context into a file. The handler takes a parameter which specifies where on the filesystem to write this data. The parameter is not validated, allowing a malicious user to overwrite arbitrary files where the user running HHVM has write access. This issue affects HHVM versions prior to 4.56.2, all versions between 4.57.0 and 4.78.0, as well as 4.79.0, 4.80.0, 4.81.0, 4.82.0, and 4.83.0.	Hhvm
CVE-2021-39207	Sep 10, 2021	parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.	Parlai
CVE-2021-24040	Sep 10, 2021	Due to use of unsafe YAML deserialization logic Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.	Parlai
CVE-2021-24036	Jul 23, 2021	Passing an attacker controlled size when creating an IOBuf could cause integer overflow Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.	Folly Hhvm
CVE-2021-24037	Jun 15, 2021	A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.	Hermes
CVE-2020-1920	Jun 01, 2021	A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.	React Native
CVE-2021-24028	Apr 14, 2021	An invalid free in Thrift's table-based serialization An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2021.02.22.00.	Thrift
CVE-2021-24218	Apr 12, 2021	The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved.	Facebook
CVE-2021-24217	Apr 12, 2021	The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution.	Facebook
CVE-2021-24029	Mar 15, 2021	A packet of death scenario is possible in mvfst A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.	Proxygen Mvfst
CVE-2020-1900	Mar 11, 2021	When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This pre-reservation was not occurring in HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.	Hhvm
CVE-2020-1899	Mar 11, 2021	The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.	Hhvm
CVE-2020-1898	Mar 11, 2021	The fb_unserialize function did not impose a depth limit for nested deserialization The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.	Hhvm
CVE-2020-1919	Mar 10, 2021	Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.	Hhvm
CVE-2021-24030	Mar 10, 2021	The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allows a malicious URL to cause code execution. This issue affects versions prior to v1.26.0.	Gameroom
CVE-2021-24025	Mar 10, 2021	Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading to a heap overflow. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.	Hhvm
CVE-2020-1918	Mar 10, 2021	In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.	Hhvm
CVE-2020-1917	Mar 10, 2021	xbuf_format_converter xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.	Hhvm