ReactPHP HTTP CVE-2026-84997

No special configuration is required - remote unauthenticated exploitation works against default configurations of any service using React\Http\HttpServer (inbound request bodies) or any client using React\Http\Browser (outbound response bodies) on affected versions 0.6.0 through 1.11.0. The only precondition is that the affected code path processes a Transfer-Encoding: chunked body, which is standard HTTP handling. Limiting factors: for the server direction, a reverse proxy that normalizes/re-encodes inbound chunked requests will neutralize the attack - but this protection does NOT extend to the Browser client direction, where a malicious or compromised upstream server can freeze the client regardless of any inbound proxy. Because ReactPHP is single-threaded and event-loop driven, one looping request halts the entire process, amplifying impact.

This is a genuine availability-only issue whose real-world risk is moderate and context-dependent, not a hollow high-CVSS number. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) is well-calibrated for CWE-835: a remote, unauthenticated actor sends a trivially malformed chunked body and the ChunkedDecoder spins in an infinite loop, consuming 100% CPU and freezing the affected process (C:N/I:N confirm no data exposure or tampering - pure DoS). No SSVC decision data, EPSS score, KEV listing, or weaponized POC is present in the input, so there is no evidence of active or automated exploitation at this time - this remains a patch-priority-by-severity item, not an emergency. The bidirectional nature raises risk versus a typical server-only DoS: the same decoder handles inbound request bodies for React\Http\HttpServer AND outbound response bodies for React\Http\Browser, so a malicious client can freeze the server and, critically, a malicious/compromised upstream server can freeze the client - and the advisory explicitly notes a normalizing reverse proxy protects only the server direction, leaving Browser (outbound) requests exposed. Confidence in the mechanism is high because the fix commit and its regression tests spell out the exact triggering inputs.

A malicious client (or, for the Browser client, a malicious/compromised upstream server) sends a chunked HTTP body ending in an incomplete terminal-chunk trailer such as "0\r\nab" with no terminating CRLF, or a completed chunk followed by exactly two non-CRLF bytes like "2\r\nabXY". The buffer stops shrinking, handleData loops forever, and the single-threaded ReactPHP event loop pins a CPU core and stops serving all other connections. No public weaponized exploit is identified, but the fix commit's regression tests document the exact trigger strings, making reproduction trivial.