CVE-2026-44907
react-server-dom: Denial of Service in Server Functions
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).
- Record
CVE-2026-44907- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
EUVDEUVD-2026-46307
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).
- Record
EUVD-2026-46307- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wx67-qw84-cm4g
react-server-dom: Denial of Service in Server Functions
Impact
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.
We recommend updating immediately.
The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of:
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
Patches
Fixes were back ported to versions 19.0.8, 19.1.9, and 19.2.8.
If you are using any of the above packages please upgrade to any of the fixed versions immediately.
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
- Record
GHSA-wx67-qw84-cm4g- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
NVD
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).
- Record
CVE-2026-44907- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).
- Record
CVE-2026-44907- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-wx67-qw84-cm4g
react-server-dom: Denial of Service in Server Functions
Impact
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.
We recommend updating immediately.
The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of:
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
Patches
Fixes were back ported to versions 19.0.8, 19.1.9, and 19.2.8.
If you are using any of the above packages please upgrade to any of the fixed versions immediately.
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
- Record
GHSA-wx67-qw84-cm4g- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
Show 10 moreShow less
OSVCLSA-2026-1785204577 No score
TuxCare security update for react-server-dom-esm (1 CVE)
TuxCare rebuilt react-server-dom-esm to address 1 CVE. Fixed in 19.2.0-tuxcare.6.
- Record
CLSA-2026-1785204577- Updated
- 2026-11-03
OSVCLSA-2026-1792161469 No score
TuxCare security update for react-art (1 CVE)
TuxCare rebuilt react-art to address 1 CVE. Fixed in 19.2.0-tuxcare.6.
- Record
CLSA-2026-1792161469- Updated
- 2026-11-02
OSVCLSA-2026-1792161491 No score
TuxCare security update for react-is (1 CVE)
TuxCare rebuilt react-is to address 1 CVE. Fixed in 19.2.0-tuxcare.6.
- Record
CLSA-2026-1792161491- Updated
- 2026-11-02
OSVCLSA-2026-1792161642 No score
TuxCare security update for react-server-dom-turbopack (1 CVE)
TuxCare rebuilt react-server-dom-turbopack to address 1 CVE. Fixed in 19.2.0-tuxcare.6.
- Record
CLSA-2026-1792161642- Updated
- 2026-11-02
OSVCLSA-2026-1792161657 No score
TuxCare security update for react-server-dom-webpack (1 CVE)
TuxCare rebuilt react-server-dom-webpack to address 1 CVE. Fixed in 19.2.0-tuxcare.6.
- Record
CLSA-2026-1792161657- Updated
- 2026-11-02
OSVCLSA-2026-1792251862 No score
TuxCare security update for react-server-dom-parcel (1 CVE)
TuxCare rebuilt react-server-dom-parcel to address 1 CVE. Fixed in 19.2.0-tuxcare.6.
- Record
CLSA-2026-1792251862- Updated
- 2026-11-02
OSVCLSA-2026-1792267916 No score
TuxCare security update for react-dom (1 CVE)
TuxCare rebuilt react-dom to address 1 CVE. Fixed in 19.2.0-tuxcare.6.
- Record
CLSA-2026-1792267916- Updated
- 2026-11-02
OSVCLSA-2026-1792287258 No score
TuxCare security update for react-test-renderer (1 CVE)
TuxCare rebuilt react-test-renderer to address 1 CVE. Fixed in 19.2.0-tuxcare.6.
- Record
CLSA-2026-1792287258- Updated
- 2026-11-02
OSVCLSA-2026-1793295328 No score
TuxCare security update for react-server-dom-turbopack (2 CVEs)
TuxCare rebuilt react-server-dom-turbopack to address 2 CVEs. Fixed in 19.0.0-tuxcare.2.
- Record
CLSA-2026-1793295328- Updated
- 2026-11-02
OSVCLSA-2026-1793297326 No score
TuxCare security update for react-server-dom-webpack (2 CVEs)
TuxCare rebuilt react-server-dom-webpack to address 2 CVEs. Fixed in 19.0.0-tuxcare.3.
- Record
CLSA-2026-1793297326- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
react-server-dom-webpacknpm |
19.0.0 up to 19.0.8 | 19.0.8 |
react-server-dom-turbopacknpm |
19.0.0 up to 19.0.8 | 19.0.8 |
react-server-dom-turbopacknpm |
19.1.0 up to 19.1.9 | 19.1.9 |
react-server-dom-parcelnpm |
19.1.0 up to 19.1.9 | 19.1.9 |
react-server-dom-webpacknpm |
19.1.0 up to 19.1.9 | 19.1.9 |
react-server-dom-turbopacknpm |
19.2.0 up to 19.2.8 | 19.2.8 |
react-server-dom-parcelnpm |
19.2.0 up to 19.2.8 | 19.2.8 |
react-server-dom-webpacknpm |
19.2.0 up to 19.2.8 | 19.2.8 |
react-server-dom-esmTuxCare:npm |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.6, plus listed versions 19.2.019.2.0-tuxcare.119.2.0-tuxcare.219.2.0-tuxcare.319.2.0-tuxcare.419.2.0-tuxcare.5 |
19.2.0-tuxcare.6 |
react-artTuxCare:npm |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.6, plus listed versions 19.2.019.2.0-tuxcare.5 |
19.2.0-tuxcare.6 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
react-isTuxCare:npm |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.6, plus listed versions 19.2.019.2.0-tuxcare.5 |
19.2.0-tuxcare.6 |
react-server-dom-turbopackTuxCare:npm |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.6, plus listed versions 19.2.019.2.0-tuxcare.5 |
19.2.0-tuxcare.6 |
react-server-dom-webpackTuxCare:npm |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.6, plus listed versions 19.2.019.2.0-tuxcare.5 |
19.2.0-tuxcare.6 |
react-server-dom-parcelTuxCare:npm |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.6, plus listed versions 19.2.019.2.0-tuxcare.5 |
19.2.0-tuxcare.6 |
react-domTuxCare:npm |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.6, plus listed versions 19.2.019.2.0-tuxcare.119.2.0-tuxcare.219.2.0-tuxcare.319.2.0-tuxcare.419.2.0-tuxcare.5 |
19.2.0-tuxcare.6 |
react-test-rendererTuxCare:npm |
19.2.0-tuxcare.0 up to 19.2.0-tuxcare.6, plus listed versions 19.2.019.2.0-tuxcare.5 |
19.2.0-tuxcare.6 |
react-server-dom-turbopackTuxCare:npm From an advisory covering 2 CVEs |
19.0.0-tuxcare.0 up to 19.0.0-tuxcare.2, plus listed versions 19.0.0 |
19.0.0-tuxcare.2 |
react-server-dom-webpackTuxCare:npm From an advisory covering 2 CVEs |
19.0.0-tuxcare.0 up to 19.0.0-tuxcare.3, plus listed versions 19.0.0 |
19.0.0-tuxcare.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-44907 is a high vulnerability (CVSS 7.5) in Meta React-server-dom-parcel, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in react-server-dom-webpack 19.0.8.