CVE-2026-44907: High severity npm/react-server-dom-webpack vulnerability

Published Jul 21, 2026
·
Updated

Impact

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.

We recommend updating immediately.

The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of: - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack

Patches

Fixes were back ported to versions 19.0.8, 19.1.9, and 19.2.8.

If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

Other sources

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).

— NVD

Affected Software

11 affected componentsFixes available
npm/react-server-dom-webpack>=19.0.0<=19.0.7, >=19.1.0<=19.1.8, >=19.2.0<=19.2.7
npm/react-server-dom-parcel>=19.0.0<=19.0.7, >=19.1.0<=19.1.8, >=19.2.0<=19.2.7
npm/react-server-dom-turbopack>=19.0.0<=19.0.7, >=19.1.0<=19.1.8, >=19.2.0<=19.2.7
npm/react-server-dom-webpack>=19.2.0<19.2.8
19.2.8
npm/react-server-dom-parcel>=19.2.0<19.2.8
19.2.8
npm/react-server-dom-turbopack>=19.2.0<19.2.8
19.2.8
npm/react-server-dom-webpack>=19.1.0<19.1.9
19.1.9
npm/react-server-dom-parcel>=19.1.0<19.1.9
19.1.9
npm/react-server-dom-turbopack>=19.1.0<19.1.9
19.1.9
npm/react-server-dom-turbopack>=19.0.0<19.0.8
19.0.8
npm/react-server-dom-webpack>=19.0.0<19.0.8
19.0.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/react-server-dom-webpack to a version that resolves this vulnerability.

    Fixed in 19.2.8
  2. Upgrade

    Upgrade npm/react-server-dom-parcel to a version that resolves this vulnerability.

    Fixed in 19.2.8
  3. Upgrade

    Upgrade npm/react-server-dom-turbopack to a version that resolves this vulnerability.

    Fixed in 19.2.8
  4. Upgrade

    Upgrade npm/react-server-dom-webpack to a version that resolves this vulnerability.

    Fixed in 19.1.9
  5. Upgrade

    Upgrade npm/react-server-dom-parcel to a version that resolves this vulnerability.

    Fixed in 19.1.9
  6. Upgrade

    Upgrade npm/react-server-dom-turbopack to a version that resolves this vulnerability.

    Fixed in 19.1.9
  7. Upgrade

    Upgrade npm/react-server-dom-turbopack to a version that resolves this vulnerability.

    Fixed in 19.0.8
  8. Upgrade

    Upgrade npm/react-server-dom-webpack to a version that resolves this vulnerability.

    Fixed in 19.0.8
  9. Upgrade

    Upgrade react-server-dom-webpack to a version that resolves this vulnerability.

    Fixed in 19.0.8
  10. Upgrade

    Upgrade react-server-dom-webpack to a version that resolves this vulnerability.

    Fixed in 19.1.9
  11. Upgrade

    Upgrade react-server-dom-webpack to a version that resolves this vulnerability.

    Fixed in 19.2.8
  12. Upgrade

    Upgrade react-server-dom-parcel to a version that resolves this vulnerability.

    Fixed in 19.0.8
  13. Upgrade

    Upgrade react-server-dom-parcel to a version that resolves this vulnerability.

    Fixed in 19.1.9
  14. Upgrade

    Upgrade react-server-dom-parcel to a version that resolves this vulnerability.

    Fixed in 19.2.8
  15. Upgrade

    Upgrade react-server-dom-turbopack to a version that resolves this vulnerability.

    Fixed in 19.0.8
  16. Upgrade

    Upgrade react-server-dom-turbopack to a version that resolves this vulnerability.

    Fixed in 19.1.9
  17. Upgrade

    Upgrade react-server-dom-turbopack to a version that resolves this vulnerability.

    Fixed in 19.2.8

Event History

Jul 21, 2026
CVE Published
via MITRE·04:03 PM
Data Sourced
via MITRE·04:03 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverity
Jul 24, 2026
Advisory Published
via GitHub·09:12 PM
Data Sourced
via GitHub·09:12 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-44907?

CVE-2026-44907 has a severity score of 7.5, indicating it is a high risk vulnerability.

2

What can exploit CVE-2026-44907?

CVE-2026-44907 can be exploited by sending specially crafted HTTP requests to server function endpoints.

3

What is the impact of CVE-2026-44907?

Exploitation of CVE-2026-44907 can lead to a denial of service due to excessive CPU usage.

4

Which packages are affected by CVE-2026-44907?

CVE-2026-44907 affects npm/react-server-dom-webpack, npm/react-server-dom-parcel, and npm/react-server-dom-turbopack packages.

5

How do I fix CVE-2026-44907?

To mitigate CVE-2026-44907, upgrade to the latest versions of the affected packages.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203