A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages:…

High CVSS 7.5

CVECVE-2026-44907

First seen2026-07-21 22:15 UTC

Disclosed2026-07-21 17:17 UTC

Last updated2026-07-21 22:15 UTC

Channel statusauto

Summary

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://github.com/react/react/security/advisories/GHSA-wx67-qw84-cm4g

Timeline

2026-07-21 nvd_ingest NVD