This vulnerability (CVE-2026-44907) affects Meta's react-server-dom-turbopack, react-server-dom-webpack, and react-server-dom-parcel packages. An attacker can cause a denial of service by sending specially crafted HTTP requests to server function endpoints, resulting in excessive CPU consumption. The issue is classified under CWE-502 (Deserialization of Untrusted Data) and CWE-400 (Uncontrolled Resource Consumption). The CVSS 3.1 base score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). The affected versions explicitly include 19.0.0, 19.1.0, and 19.2.0 and their respective minor versions up to 19.0.7, 19.1.8, and 19.2.7. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation leads to denial of service by causing excessive CPU usage on the affected server endpoints. This impacts availability but does not affect confidentiality or integrity. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing network-level protections such as rate limiting or filtering suspicious requests targeting server function endpoints to reduce risk.