CVE-2026-44907

HighCVSS 7.5/10Last modified Jul 21, 2026

Description

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Meta	react-server-dom-turbopack	>= 19.0.0, <= 19.0.7; >= 19.1.0, <= 19.1.8; >= 19.2.0, <= 19.2.7
Meta	react-server-dom-parcel	>= 19.0.0, <= 19.0.7; >= 19.1.0, <= 19.1.8; >= 19.2.0, <= 19.2.7
Meta	react-server-dom-webpack	>= 19.0.0, <= 19.0.7; >= 19.1.0, <= 19.1.8; >= 19.2.0, <= 19.2.7

References

https://github.com/react/react/security/advisories/GHSA-wx67-qw84-cm4g

Timeline

Published: Jul 21, 2026
Last modified: Jul 21, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-449097.5Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exp CVE-2026-44918.8A vulnerability has been found in Tenda A18 Pro 02.03.02.28. Impacted is the function fromSetIpMacBind of the file /goform/SetIpMacBind. Suc CVE-2026-449116.3Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access CVE-2026-449137.2Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injec CVE-2026-449147.2Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Req CVE-2026-449156.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default configuration of cas-auth in Apache APISIX CVE-2026-449163.0In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.CVE-2026-449174.9OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a p CVE-2026-449185.5OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.CVE-2026-449196.5In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///CVE-2026-44928.8A vulnerability was found in Tenda A18 Pro 02.03.02.28. The affected element is the function set_qosMib_list of the file /goform/formSetQosB CVE-2026-449236.5SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges.