What is the CVSS score of CVE-2026-44907?

CVE-2026-44907 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of React Server DOM are affected by CVE-2026-44907?

React Server Components runtime versions 19.0-19.2 contain a denial-of-service vulnerability allowing unauthenticated remote attackers to exhaust CPU resources and disable affected applications…. A patch is available.

How to fix or mitigate CVE-2026-44907?

Within 24 hours, enumerate all React 19.x deployments and confirm which run versions 19.0.0-19.0.7, 19.1.0-19.1.8, or 19.2.0-19.2.7 with Server Components active; assess internet-facing exposure and downtime impact to business operations. Within 7 days, deploy compensating controls: implement strict rate limiting and request size caps on all Server Function endpoints, configure Web Application Firewall rules to block malformed POST payloads, enable CPU and POST-traffic alerting, and restrict network access to Server Components endpoints where business logic allows. Within 30 days, monitor vendor advisories for patch release, prepare test and rollback procedures for upgrade to React 19.3.0 or later once patched, and consider temporary rollback to React 18.x if available as an alternative.

React Server DOM CVE-2026-44907

EUVD-2026-46307 HIGH

2026-07-21 Meta

GHSA-wx67-qw84-cm4g

Denial Of Service React Server Dom Turbopack React Server Dom Parcel React Server Dom Webpack

7.5

CVSS 3.1 · Vendor: Meta

Severity by source

Vendor (Meta) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP requests to default server-action endpoints (AV:N/AC:L/PR:N/UI:N) cause CPU-exhaustion DoS with no data impact, so A:H and C/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Meta).

CVSS VectorVendor: Meta

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 16:45 vuln.today

CVE Published

Jul 21, 2026 - 16:03 cve.org

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

10 npm packages depend on react-server-dom-webpack (6 direct, 4 indirect)

Ecosystem-wide dependent count for version 19.0.0.

DescriptionCVE.org

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).

AnalysisAI

Denial of service in React's Server Components runtime (react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack) lets remote unauthenticated attackers spike CPU to exhaustion by POSTing specially crafted HTTP requests to Server Function ('use server') endpoints across versions 19.0.0-19.0.7, 19.1.0-19.1.8, and 19.2.0-19.2.7. The flaw was reported by Meta (React's maintainer) and carries CVSS 7.5 (availability-only impact). No public exploit is identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected packages are the server-side bindings that implement React Server Components (RSC) and Server Functions ('use server' actions) for three bundler ecosystems: webpack (used by Next.js App Router), Turbopack (Next.js's Rust-based bundler), and Parcel. These endpoints deserialize and dispatch client-originated payloads to server functions; a malformed or adversarially structured request causes disproportionate, unbounded processing work, consuming excessive CPU. No CWE was assigned in the input, but the behavior is characteristic of CWE-400 (Uncontrolled Resource Consumption) / CWE-1333-style algorithmic complexity where attacker-controlled input drives worst-case processing cost. The three CPE strings (cpe:2.3:a:meta:react-server-dom-webpack, :react-server-dom-parcel, :react-server-dom-turbopack) confirm all three bundler variants share the vulnerable code path.

RemediationAI

Upgrade each affected package to a fixed release above its vulnerable range - i.e., beyond 19.0.7, 19.1.8, and 19.2.7 respectively; the exact patched version numbers are not stated in the provided input, so consult the GHSA-wx67-qw84-cm4g advisory (https://github.com/react/react/security/advisories/GHSA-wx67-qw84-cm4g) for the precise fixed versions rather than assuming them, and update the corresponding React/Next.js dependency that pulls in react-server-dom-webpack/-parcel/-turbopack. If immediate upgrade is not possible, apply compensating controls at the edge: place a WAF or reverse proxy in front of the Server Function endpoints to rate-limit and cap request body size/complexity for POSTs to 'use server' action routes, and enforce per-client request throttling and CPU/time limits on the Node.js server or serverless function (trade-off: aggressive rate limits may reject legitimate high-volume action traffic). Restricting or authenticating access to the server-action endpoints where feasible also reduces exposure, at the cost of breaking anonymous/public interactivity.