CVE-2026-84997

ReactPHP's react/http package, an event-driven streaming HTTP client and server library, contains an unauthenticated denial-of-service flaw (CWE-835, infinite loop) in its ChunkedDecoder component, present from version 0.6.0 through versions before 1.11.1. Because the decoder's handleData routine only exits its loop when the buffer shrinks on each iteration, a malformed Transfer-Encoding: chunked body — an incomplete terminal-chunk trailer lacking CRLF, or exactly two non-CRLF bytes after a completed non-terminal chunk — leaves the buffer unchanged and loops forever. A malicious client can therefore freeze any server built on React\Http\HttpServer by sending a crafted request body, and a malicious or compromised server can freeze any client using React\Http\Browser via a crafted response body, hanging the event loop and every connection it serves. A reverse proxy that normalizes inbound requests may shield the server direction but does not protect outbound Browser requests. No public proof-of-concept or exploitation has been reported (not in CISA KEV), and the flaw is fixed in react/http 1.11.1.

What to do: Upgrade react/http to 1.11.1 or later (e.g., composer update react/http) and verify the patched version in composer.lock and the vendor directory. Until patched, place a reverse proxy that normalizes or rejects malformed chunked requests in front of HttpServer — noting this does not protect outbound Browser requests — and restrict Browser use to trusted servers. Audit PHP applications for this dependency, since Composer packages are often invisible in conventional asset inventories.