High-Severity DoS Vulnerability in React Server Components (CVE-2026-44907)
CVE-2026-44907 (CVSS 7.5) allows unauthenticated remote attackers to trigger CPU exhaustion and OOM conditions via crafted HTTP requests to Server Function endpoints.
CPU exhaustion and out-of-memory conditions on your React Server Function endpoints: that's CVE-2026-44907 (CVSS 7.5), a high-severity DoS hitting three packages: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. Affected versions: 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7.
The attack needs no authentication and no user interaction: any client that reaches your Server Function endpoints can trigger it. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms network-based exploitation with high availability impact and zero confidentiality or integrity loss.
Patched versions: 19.0.8, 19.1.9, 19.2.8. If you use Server Functions in production, upgrade your react-server-dom-* package now: any HTTP client can exploit this, unlike some React CVEs that need client-side interaction. Rate limiting reduces blast radius but doesn't substitute for patching. No auth, no user gesture, no excuse to wait.