7.5
High
CVE-2026-44907 A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function…
Description
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| react-server-dom-turbopack 19.2 | 19.2.0 → 19.2.7 | No fix stated |
| react-server-dom-turbopack 19.1 | 19.1.0 → 19.1.8 | No fix stated |
| react-server-dom-turbopack 19.0 | 19.0.0 → 19.0.7 | No fix stated |
| react-server-dom-parcel 19.2 | 19.2.0 → 19.2.7 | No fix stated |
| react-server-dom-parcel 19.1 | 19.1.0 → 19.1.8 | No fix stated |
| react-server-dom-parcel 19.0 | 19.0.0 → 19.0.7 | No fix stated |
| react-server-dom-webpack 19.2 | 19.2.0 → 19.2.7 | No fix stated |
| react-server-dom-webpack 19.1 | 19.1.0 → 19.1.8 | No fix stated |
| react-server-dom-webpack 19.0 | 19.0.0 → 19.0.7 | No fix stated |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of react-server-dom-turbopack
The 8 CVEs of react-server-dom-turbopack →
CVE-2026-23870
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function…
7.5
High
CVE-2026-23869
A denial of service vulnerability exists in React Server Components, affecting the following packages:…
7.5
High
CVE-2026-23864
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages:…
7.5
High
CVE-2025-67779
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a…
7.5
High