CVE-2026-104827: react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

React\Http\Browser and its lower-level HTTP stack impose no limit on the size of a response’s header section while it is being received. ClientRequestStream::handleData() appends every incoming byte to an internal buffer and only scans that buffer for the \r\n\r\n (or \n\n) terminator, without ever checking its length. A remote server that withholds the terminator and keeps streaming can grow the client’s memory without bound until PHP’s memory_limit is exhausted and the process crashes.

This is an unauthenticated, network-reachable denial of service against any application that uses react/http as a client to fetch untrusted or attacker-influenced URLs, including via redirects.