CVE-2026-84997

Name of the Vulnerable Software and Affected Versions react/http versions 0.6.0 through 1.11.0

Description A denial of service issue exists where a malformed HTTP message using Transfer-Encoding: chunked can cause the ReactHttpIoChunkedDecoder to enter an infinite loop. This occurs because the handleData() function requires the buffer to shrink on every iteration, but certain malformed inputs—such as an incomplete terminal-chunk trailer without CRLF or exactly two non-CRLF bytes after a completed non-terminal chunk—leave the buffer unchanged. Since ReactPHP is single-threaded, this pegs a CPU core and freezes the entire event loop, stalling the process for all clients.

This affects both request bodies processed for ReactHttpHttpServer and response bodies processed for ReactHttpBrowser, meaning a malicious client can freeze a server, or a compromised server can freeze a client. While a reverse proxy that normalizes inbound requests may protect the server, it does not protect outbound requests made via the Browser component.

Recommendations Update react/http to version 1.11.1.