Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Meta

Description

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Meta react-server-dom-turbopack

Default version status: unaffected

  • 19.0.0 to ≤ 19.0.7affected
  • 19.1.0 to ≤ 19.1.8affected
  • 19.2.0 to ≤ 19.2.7affected

Meta react-server-dom-parcel

Default version status: unaffected

  • 19.0.0 to ≤ 19.0.7affected
  • 19.1.0 to ≤ 19.1.8affected
  • 19.2.0 to ≤ 19.2.7affected

Meta react-server-dom-webpack

Default version status: unaffected

  • 19.0.0 to ≤ 19.0.7affected
  • 19.1.0 to ≤ 19.1.8affected
  • 19.2.0 to ≤ 19.2.7affected

References