high · 7.5CVE-2026-84997Sep 17, 2026

CVE-2026-84997: react/http ChunkedDecoder Infinite Loop DoS

Rohit Hatagale
AI Security Researcher, SecureLayer7

Sending a malformed chunked HTTP body to a ReactPHP server (or receiving one from a malicious server) traps the single-threaded PHP process in an infinite loop, pinning a CPU core and making the…

Packagereact/http
Ecosystemcomposer
Affected>= 0.6.0, <= 1.11.0
Fixed in1.11.1

The problem

React\Http\Io\ChunkedDecoder::handleData() loops while the internal buffer is non-empty, assuming the buffer shrinks each pass. Two malformed inputs break that assumption and cause an infinite loop.

Because ReactPHP is single-threaded, one stalled loop freezes every client on the process. Both HttpServer (inbound request bodies) and Browser (outbound response bodies) are affected, so attackers can hit server and client paths.

Proof of concept

A working proof-of-concept for CVE-2026-84997 in react/http, with the exact payload below.

http
POST / HTTP/1.1
Host: x
Transfer-Encoding: chunked

0
ab

Trigger 1 (terminal-chunk trailer, shown in payload): after the zero-size terminal chunk, the decoder tries to skip trailer bytes by slicing the buffer at the next CRLF. With no CRLF present, strpos() returns false; PHP coerces false to 0 in substr(), so the buffer is never advanced.

Neither the error guard (requires non-zero chunk size) nor the wait guard (requires fewer than two bytes) can fire, so the loop re-enters with identical state indefinitely.

Trigger 2 (off-by-one after a completed chunk): send body 1\r\nA followed by exactly two non-CRLF bytes (e.g. 1\r\nAAB). Once the data chunk is consumed, the remaining two bytes slip between the error guard (strlen > 2) and the wait guard (strlen < 2), and nothing is consumed on the next iteration.

The patch (commit b6d4688) adds an explicit break or buffer-advance in both code paths so the loop exits instead of spinning.

The fix

Upgrade react/http to 1.11.1 (composer require react/http:^1.11.1). If an immediate upgrade is not possible, place a normalizing reverse proxy such as nginx in front of the application for the server direction; note this does not protect outbound Browser requests.

Reported by jsifuentes and raiFork.

References: [1][2][3][4][5][6]

Related research