CVE-2026-44907: react-server-dom-webpack Denial of Service in Server Functions
Sending a specially crafted HTTP request to a React Server Function endpoint can exhaust server memory or CPU, taking the application offline without any authentication required.
The problem
The React Flight protocol deserializer in react-server-dom-webpack (and its parcel/turbopack siblings) does not enforce adequate structural limits on inbound Server Function payloads.
An unauthenticated attacker can POST a malformed Flight stream to any Server Function endpoint, triggering out-of-memory exceptions or excessive CPU consumption. No credentials, cookies, or prior knowledge of the application are needed.
The fix
Upgrade to react-server-dom-webpack >= 19.0.8, react-server-dom-parcel >= 19.0.8, or react-server-dom-turbopack >= 19.0.8 (also fixed in the 19.1.9 and 19.2.8 backport lines). Applications that do not use React Server Components or Server Functions are not affected.
If you cannot upgrade immediately, place a WAF rule or reverse-proxy filter in front of Server Function endpoints to reject oversized or structurally abnormal POST bodies.
Related research
- high · 7.5CVE-2026-14257CVE-2026-14257: brace-expansion Unbounded Expansion Length DoS (OOM Crash)
- high · 7.5CVE-2026-50272CVE-2026-50272: dd-trace Unbounded W3C Baggage Extraction DoS
- high · 7.5CVE-2026-49866CVE-2026-49866: @libp2p/gossipsub CPU DoS via Oversized IHAVE and IWANT Control Messages
- highShescape: Quadratic-Time Denial of Service in Flag Protection