CVE-2026-44907

highCVSS 7.5covered by 2 sourcesfirst seen 2026-07-21

Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of: - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack Patches Fixes were back ported to versions 19.0.8, 19.1.9, and 19.2.8. If you are using any of the above packages please upgrade to any of the fixed versions immediately. If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

⚡ Watch CVE-2026-44907

Get an email if CVE-2026-44907 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.

Advisory coverage (2)

highGHSA-wx67-qw84-cm4g: react-server-dom: Denial of Service in Server Functionsghsa · 2026-07-24
highCVE-2026-44907: A denial of service vulnerability could be triggered by sending specially crafted HTTP request…nvd · 2026-07-21

External references

NVD record for CVE-2026-44907

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-44907 status](https://www.csirts.com/badge/CVE-2026-44907)](https://www.csirts.com/cve/CVE-2026-44907)