CVE-2026-44907 HIGH CVSS 7.5 react_server_dom_webpack Verified Advisory

Denial of service in React Server DOM bundler packages (CVE-2026-44907)

Denial Of Service React Server Dom Turbopack React Server Dom Parcel React Server Dom Webpack

A denial of service vulnerability exists in the React server DOM packages for webpack, Parcel, and Turbopack. Sending specially crafted HTTP requests to server function endpoints can trigger out-of-memory exceptions or excessive CPU usage. Applications using these packages with React Server Components support are affected; apps without a server or without RSC-capable bundler integration are not. Affected versions: - 19.0.0 - 19.0.1 - 19.0.2 - 19.0.3 - 19.0.4 - 19.0.5 - 19.0.6 - 19.0.7 - 19.1.0 - 19.1.1 - 19.1.2 - 19.1.3 - 19.1.4 - 19.1.5 - 19.1.6 - 19.1.7 - 19.1.8 - 19.2.0 - 19.2.1 - 19.2.2 - 19.2.3 - 19.2.4 - 19.2.5 - 19.2.6 - 19.2.7 We recommend updating to: 19.0.8, 19.1.9, 19.2.8. CVSS 7.5 · our assessment: this_week Reference: https://github.com/react/react/security/advisories/GHSA-wx67-qw84-cm4g Details: https://vuln.today/cve/CVE-2026-44907

Verified by vuln.today against published advisories.

Affected versions

– 19.0.0
– 19.0.1
– 19.0.2
– 19.0.3
– 19.0.4
– 19.0.5
– 19.0.6
– 19.0.7
– 19.1.0
– 19.1.1
– 19.1.2
– 19.1.3
– 19.1.4
– 19.1.5
– 19.1.6
– 19.1.7
– 19.1.8
– 19.2.0
– 19.2.1
– 19.2.2
– 19.2.3
– 19.2.4
– 19.2.5
– 19.2.6
– 19.2.7

Fixed in: 19.0.8; 19.1.9; 19.2.8

Full CVE analysis Reference Published Jul 21, 2026

← All verified advisories