CVE-2026-44907: 
React Server Components vulnerability analysis and mitigation

CVE-2026-44907 is a Denial of Service vulnerability in Meta's React Server DOM packages — react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack — that can be triggered by sending specially crafted HTTP requests to server function endpoints, leading to out-of-memory exceptions or excessive CPU usage. It affects versions 19.0.0–19.0.7, 19.1.0–19.1.8, and 19.2.0–19.2.7 of all three packages. The vulnerability was published on July 21, 2026, and the GitHub Security Advisory (GHSA-wx67-qw84-cm4g) was reviewed on July 24, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, React Security Advisory).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the affected packages fail to impose adequate restrictions on resource allocation when processing incoming requests at server function endpoints. An unauthenticated remote attacker can send specially crafted HTTP requests to these endpoints, causing the server to consume excessive CPU cycles or exhaust available memory. No authentication or user interaction is required, and attack complexity is low, making this straightforward to exploit against any application using React Server Components with one of the affected bundler integrations. Applications that do not use a server or do not use a framework/bundler supporting React Server Components are not affected (GitHub Advisory, React Security Advisory).

Successful exploitation results in a denial of service condition — specifically, out-of-memory exceptions or excessive CPU consumption — rendering the affected server unresponsive or causing a crash. There is no impact on confidentiality or data integrity; the sole consequence is high availability impact to the affected service. Applications relying on React Server Components for server-side rendering or server function execution are at risk of complete service disruption (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (React Security Advisory). The NVD SSVC assessment classifies exploitation as "none" and the attack as "automatable," indicating that while no exploitation has been observed, the low-complexity, unauthenticated network attack vector makes automated exploitation feasible. The EPSS score is approximately 0.329% (25th percentile), reflecting a currently low but non-negligible probability of exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify internet-facing applications using React Server Components with react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack versions 19.0.0–19.0.7, 19.1.0–19.1.8, or 19.2.0–19.2.7. This can be done by inspecting HTTP response headers, JavaScript bundle contents, or framework fingerprints.
2. Identify server function endpoints: Locate exposed server function endpoints in the target application. These are typically registered by the React Server Components framework/bundler integration and accept HTTP POST requests.
3. Craft malicious HTTP requests: Construct specially crafted HTTP requests (e.g., with malformed, oversized, or deeply nested payloads) targeting the identified server function endpoints to trigger uncontrolled resource consumption.
4. Send requests at volume: Repeatedly send the crafted requests to the target endpoints. Due to the lack of rate limiting or resource throttling in the vulnerable code paths, each request causes excessive CPU usage or memory allocation.
5. Achieve denial of service: The server exhausts available CPU or memory resources, resulting in out-of-memory exceptions or an unresponsive service, effectively denying access to legitimate users (GitHub Advisory, React Security Advisory).

• Network: Unusual spike in HTTP POST requests targeting server function endpoints; high-volume or repeated requests from single or distributed IP addresses to React Server Component handler paths.
• Logs: Server access logs showing a surge of requests to server function endpoints with abnormal payload sizes or structures; error logs containing out-of-memory exceptions or CPU throttling warnings from the Node.js process.
• Process: Node.js server process exhibiting sustained near-100% CPU utilization or rapidly growing memory consumption without a corresponding increase in legitimate traffic; process crashes or restarts correlated with incoming HTTP request bursts.
• Application: Increased frequency of server restarts or health check failures in orchestration platforms (e.g., Kubernetes, PM2) coinciding with unusual inbound HTTP traffic patterns.

Meta has released patched versions 19.0.8, 19.1.9, and 19.2.8 for all three affected packages (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack); upgrading immediately is the recommended remediation (GitHub Advisory, React Security Advisory). As interim mitigations, operators should implement network-level rate limiting on server function endpoints and deploy Web Application Firewall (WAF) rules to detect and block malicious or oversized HTTP requests targeting these endpoints. Applications that do not use a server or do not use a framework/bundler supporting React Server Components are not affected and require no action.

The advisory was published by Meta engineer hoxyq on the official React GitHub repository on July 21, 2026, with an immediate recommendation to upgrade (React Security Advisory). No notable independent researcher commentary, significant social media discussion, or major media coverage has been identified at this time beyond standard vulnerability database aggregation.