CVE-2026-44907: React Server DOM DoS Vulnerability

CVE-2026-44907 Overview

CVE-2026-44907 is a denial of service vulnerability affecting React's server component packages. Attackers can send specially crafted HTTP requests to server function endpoints, causing excessive CPU consumption on the target server. The flaw impacts react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack across multiple version ranges. The vulnerability requires no authentication and no user interaction, making internet-facing applications directly exposed to remote abuse.

Critical Impact
Unauthenticated remote attackers can exhaust CPU resources on servers running vulnerable React server component packages, degrading or halting application availability.

Affected Products

react-server-dom-webpack versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7
react-server-dom-parcel versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7
react-server-dom-turbopack versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7

Discovery Timeline

2026-07-21 - CVE-2026-44907 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-44907

Vulnerability Analysis

The vulnerability resides in the React Server Components (RSC) request handling logic used by the react-server-dom-* bundler integration packages. Server functions, invoked over HTTP to execute server-side logic from client components, accept payloads that the affected packages parse before dispatch. Malformed or maliciously structured payloads cause disproportionate processing overhead relative to the input size.

The result is a classic algorithmic resource consumption issue. A single small HTTP request can pin CPU cores for extended durations, and repeated requests scale the impact linearly across worker processes. Node.js runtimes are particularly susceptible because the event loop stalls while parsing runs, blocking unrelated requests.

Root Cause

The root cause is insufficient bounds and complexity controls when processing server function request payloads. The parsing path performs work that grows non-linearly with attacker-controlled input structure, without an early rejection guard. This is a resource exhaustion condition rather than a memory-safety flaw.

Attack Vector

Exploitation occurs over the network against any endpoint that dispatches to React server functions. The attacker crafts an HTTP request targeting the server action route and submits a payload designed to trigger the expensive parsing path. No credentials, no session, and no user interaction are required. Refer to the GitHub Security Advisory GHSA-wx67-qw84-cm4g for technical specifics.

No verified proof-of-concept code has been published. The vulnerability mechanism is documented in prose in the upstream advisory.

Detection Methods for CVE-2026-44907

Indicators of Compromise

Sustained CPU saturation on Node.js processes serving React applications without a corresponding increase in legitimate traffic volume
Elevated latency or timeouts on server action endpoints (typically POST requests carrying RSC action identifiers)
Repeated requests to server function routes from a small set of source IP addresses with unusual payload shapes
Event loop lag metrics spiking on servers running react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack

Detection Strategies

Inventory Node.js dependencies with npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack and flag versions within the vulnerable ranges
Correlate web server access logs with process-level CPU metrics to surface request patterns that consistently precede CPU spikes
Add application performance monitoring alerts for prolonged single-request handler durations on server action routes

Monitoring Recommendations

Track HTTP request rate, payload size, and response time on all React server action endpoints and alert on statistical outliers
Monitor Node.js eventLoopUtilization and per-worker CPU consumption; sustained values near 100% warrant investigation
Enable structured logging on the RSC dispatch layer to record payload metadata for retrospective analysis

How to Mitigate CVE-2026-44907

Immediate Actions Required

Upgrade react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack to a patched release beyond the affected ranges as documented in the GitHub Security Advisory
Audit production deployments for any of the three packages at versions 19.0.0–19.0.7, 19.1.0–19.1.8, or 19.2.0–19.2.7
Place rate limits and request size limits in front of server action endpoints at the reverse proxy or CDN layer

Patch Information

The React project has issued fixes through the upstream advisory GHSA-wx67-qw84-cm4g. Upgrade to the latest patched minor release for each affected line (19.0.x, 19.1.x, and 19.2.x). Review the advisory for the exact fixed version numbers before pinning dependencies.

Workarounds

Enforce strict maximum request body sizes on routes handling React server functions to blunt payload amplification
Apply per-IP and per-route rate limiting on server action endpoints via a web application firewall or ingress controller
Restrict exposure of server function endpoints to authenticated sessions where the application architecture permits

bash

# Upgrade the affected packages to a patched release
npm install react-server-dom-webpack@latest \
            react-server-dom-parcel@latest \
            react-server-dom-turbopack@latest

# Verify installed versions are outside the vulnerable ranges
npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack