Log in Start free

Vulnerability · Published Jul 21, 2026 · Assigned by Meta

CVE-2026-44907

High 7.5

In plain English

A high-severity security flaw in react-server-dom-parcel from Meta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 51.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmreact-server-dom-parcel19.2.8GHSA-wx67-qw84-cm4g
npmreact-server-dom-parcel19.1.9GHSA-wx67-qw84-cm4g
npmreact-server-dom-turbopack19.2.8GHSA-wx67-qw84-cm4g
npmreact-server-dom-turbopack19.1.9GHSA-wx67-qw84-cm4g
npmreact-server-dom-turbopack19.0.8GHSA-wx67-qw84-cm4g
npmreact-server-dom-webpack19.2.8GHSA-wx67-qw84-cm4g
npmreact-server-dom-webpack19.1.9GHSA-wx67-qw84-cm4g
npmreact-server-dom-webpack19.0.8GHSA-wx67-qw84-cm4g

Affected products (as reported)

VendorProductVersions
Meta react-server-dom-turbopack 19.0.0 – through 19.0.719.1.0 – through 19.1.819.2.0 – through 19.2.7
Meta react-server-dom-parcel 19.0.0 – through 19.0.719.1.0 – through 19.1.819.2.0 – through 19.2.7
Meta react-server-dom-webpack 19.0.0 – through 19.0.719.1.0 – through 19.1.819.2.0 – through 19.2.7

References