react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

What it is: react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS. and its lower-level HTTP stack impose no limit on the size of a response's header section while it is being received. appends every incoming byte to an internal buffer and only scans that buffer for the (or ) terminator, without ever checking its length. A remote server that withholds the terminator and keeps streaming can grow the client's memory

Who is affected: - react/http (PHP, via Composer), versions >= 1.0.0, <= 1.11.0

Is it being exploited: GitHub's advisory does not say it is being exploited. GitHub rates it high (CVSS 3.1 score 7.5). It was published on 15 October 2026.

What to do: - Update react/http to 1.11.1 or later. - Check your lock file (composer.lock) to see which version you actually run, including as a dependency of something else.