UpHeron
All vulnerabilities

npm

CVE-2026-44907

react-server-dom: Denial of Service in Server Functions

Severity
High 7.5
Published
24 Jul 2026
Last changed
24 Jul 2026
Added to UpHeron
14 Oct 2026
Fixed in
19.0.8, 19.1.9, 19.2.8
Also known as
GHSA-wx67-qw84-cm4g
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
react-server-dom-parcelnpm · osv:npm:react-server-dom-parcel
  • From 19.1.0 before 19.1.9
  • From 19.2.0 before 19.2.8
react-server-dom-turbopacknpm · osv:npm:react-server-dom-turbopack
  • From 19.0.0 before 19.0.8
  • From 19.1.0 before 19.1.9
  • From 19.2.0 before 19.2.8
Reactnpm · osv:npm:react-server-dom-webpack
  • From 19.0.0 before 19.0.8
  • From 19.1.0 before 19.1.9
  • From 19.2.0 before 19.2.8

References