CVE-2026-44907Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://github.com/react/react/security/advisories/GHSA-wx67-qw84-cm4g

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-44907

Full discourse2 posts

Upwind Security MDR@UpwindMDR92d
Disclosure
🚨 HIGH - React Server Components endpoint CPU exhaustion DoS (CVE-2026-44907) CVE-2026-44907 is a denial-of-service (DoS) vulnerability in React Server Components (react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack). A remote attacker can send crafted HTTP requests to exposed server function endpoints, causing excessive CPU usage and potentially making the service unavailable. 👉 Affected: react-server-dom-webpack/react-server-dom-parcel/react-server-dom-turbopack 19.0.0-19.0.7, 19.1.0-19.1.8, 19.2.0-19.2.7 | Upgrade to No fix yet — treat as suspicious
Post summary
The post announces CVE-2026-44907, a CPU exhaustion DoS vulnerability in React Server Components, detailing affected versions and noting that no fix is available yet.
0100064
255 followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-44907 A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; … https://www.cve.org/CVERecord?id=CVE-2026-44907
Post summary
CVE-2026-44907 is a DoS vulnerability that can be triggered by crafted HTTP requests to server functions, resulting in high CPU usage; the CVE record is linked but no PoC, exploit, or patch information is provided.
00000789
57.8K followersView on X

Explore more

Back to dashboard