CVE-2026-104827

Name of the Vulnerable Software and Affected Versions react/http versions 1.0.0 through 1.11.0

Description ReactHttpBrowser fails to enforce a size limit on the internal buffer used to store response-header bytes. When the handleData() function in ClientRequestStream receives data, it appends incoming bytes to a buffer and waits for a header terminator (r r or `

). A remote server can exploit this by sending a valid status line and partial header but withholding the terminator, causing the buffer to grow indefinitely. This can lead to the exhaustion of the PHP memory limit`, resulting in a denial of service that crashes the event-loop or worker process. This issue affects applications that fetch attacker-controlled or influenced URLs, including those reached via redirects.

Recommendations Update react/http to version 1.11.1.