CVE-2026-97724 swmansion CVE debrief

Who should care

Defenders and developers who use React Native Worklets in their applications should be aware of this vulnerability and take steps to prevent exploitation. This includes verifying the version of React Native Worklets in use, reviewing code to ensure it does not pass attacker-controlled data through the affected serialization path, and monitoring for potential denial of service issues. Additionally, security teams and vulnerability management teams should be

Why it matters

Defenders should prioritize verifying the version of React Native Worklets in use and upgrading to 0.12.2 or later to prevent exploitation. This vulnerability can lead to a remotely triggered denial of service in applications that pass attacker-controlled data through the affected serialization path. Developers who use React Native Worklets in their applications should review their code and ensure they do not pass attacker-controlled data through the affected serialization path.

• Remotely triggered denial of service in applications that pass attacker-controlled data through the affected serialization path
• Potential persistence of denial of service across application restarts or repeated attempts to access affected content

Technical summary

The vulnerability exists in the clonePlainJSObject function in packages/react-native-worklets/src/memory/serializable.native.ts. An attacker can exploit this by providing a specially crafted object containing a __proto__ property, which can modify the prototype of an object created during serialization. This can lead to a remotely triggered denial of service in applications that pass attacker-controlled data through the affected serialization path. The affected versions of React Native Worklets are before 0.12.2, and defenders should prioritize verifying the version in use and upgrading to 0.12.2 or later to prevent exploitation.

Defensive priority

Defenders should prioritize verifying the version of React Native Worklets in use and upgrading to 0.12.2 or later to prevent exploitation.

Recommended defensive actions

• Verify the version of React Native Worklets in use and upgrade to 0.12.2 or later
• Review applications that use React Native Worklets and ensure they do not pass attacker-controlled data through the affected serialization path
• Monitor for and address any potential denial of service issues in applications that use React Native Worklets
• Perform a thorough review of code that interacts with React Native Worklets to identify potential vulnerabilities
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review and update incident response plans to include procedures for handling potential denials of service

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability exists in Software Mansion React Native Worklets before 0.12.2. Defenders should verify the version in use and ensure it is upgraded to 0.12.2 or later to prevent exploitation. The CVE Program and NVD entries serve as primary sources for this information. Additional details may be found in related references, but their accuracy and relevance should be verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.