CVE-2026-44907: react-server-dom: Denial of Service in Server Functions

July 24, 2026

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage.

We recommend updating immediately.

The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of:

react-server-dom-webpack
react-server-dom-parcel
react-server-dom-turbopack

References

github.com/advisories/GHSA-wx67-qw84-cm4g
github.com/react/react/security/advisories/GHSA-wx67-qw84-cm4g
nvd.nist.gov/vuln/detail/CVE-2026-44907

Code Behaviors & Features

Detect and mitigate CVE-2026-44907 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →