CVE-2026-84997: react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

Q: Which deployments are exposed to this denial of service?

React\Http\HttpServer is exposed when it processes malicious chunked request bodies from clients. React\Http\Browser is exposed when it processes chunked response bodies from a malicious or compromised server.

Q: What does an attacker need to do to trigger the issue?

An attacker needs to send a malformed Transfer-Encoding: chunked body that causes the decoder buffer not to shrink. The described triggering cases include an incomplete terminal-chunk trailer without CRLF and exactly two non-CRLF bytes after a completed non-terminal chunk.

Q: What version resolves the issue?

The issue is fixed in react/http version 1.11.1. Versions from 0.6.0 until 1.11.1 are affected.

Published Sep 16, 2026

Updated

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every iteration. An incomplete terminal-chunk trailer without CRLF left the buffer unchanged after strpos returned false, and exactly two non-CRLF bytes after a completed non-terminal chunk bypassed both the error and wait guards. The affected decoder processes request bodies for React\Http\HttpServer and response bodies for React\Http\Browser, allowing a malicious client to freeze a server or a malicious or compromised server to freeze a client. A reverse proxy that normalizes inbound requests may protect the server direction but does not protect outbound Browser requests. This issue is fixed in version 1.11.1.

Affected Software

1 affected component

react/http>=0.6.0<1.11.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade react/http to a version that resolves this vulnerability.
Fixed in 1.11.1

Event History

Sep 16, 2026

CVE Published

via MITRE·02:07 PM

Data Sourced

via MITRE·02:07 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial of service?

React\Http\HttpServer is exposed when it processes malicious chunked request bodies from clients. React\Http\Browser is exposed when it processes chunked response bodies from a malicious or compromised server.

What does an attacker need to do to trigger the issue?

An attacker needs to send a malformed Transfer-Encoding: chunked body that causes the decoder buffer not to shrink. The described triggering cases include an incomplete terminal-chunk trailer without CRLF and exactly two non-CRLF bytes after a completed non-terminal chunk.

Does a reverse proxy mitigate this issue?

A reverse proxy that normalizes inbound requests may protect the HttpServer request-processing direction. It does not protect outbound requests made through React\Http\Browser, where a remote server can send a malicious chunked response.

What version resolves the issue?