# CVE-2026-84997: ReactPHP HTTP denial of service in chunked decoder Source: https://junglewise.ai/threats/cve-2026-84997-reactphp-http-denial-of-service-in-chunked-decoder Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-09-16. Updated: 2026-09-25 License: CC BY 4.0 with a link back CVE-2026-84997 · Severity: high · CVSS 7.5 · Published 2026-09-16 ReactPHP is a PHP library used to build asynchronous web applications and HTTP clients. A malformed HTTP request or response using chunked transfer encoding can cause the library to enter an infinite loop, consuming 100% CPU and freezing the entire application until it is forcibly restarted. This affects both HTTP servers (when handling client requests) and HTTP clients (when fetching remote URLs). Technologies: [react/http (Packagist)](https://junglewise.ai/threats/technologies/react-http). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist). ## Quick answers **Is CVE-2026-84997 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84997 being exploited in the wild. **How severe is CVE-2026-84997?** High severity, with a CVSS score of 7.5, published 16 September 2026. **Which products and versions are affected?** react/http (Packagist) >= 0.6.0, <= 1.11.0, ECOSYSTEM:introduced=0.6.0,fixed=1.11.1. **Is there a fix for CVE-2026-84997?** Yes. react/http (Packagist): upgrade to 1.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-84997 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2026-84997?** Check whether you run react/http (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - react/http (Packagist): upgrade to 1.11.1 or later ```sh composer require react/http:^1.11.1 ``` ## Technical details The vulnerability is an infinite loop in `React\Http\Io\ChunkedDecoder::handleData()` triggered by malformed HTTP chunked transfer encoding. The decoder processes chunked bodies by looping while the buffer is non-empty, but two conditions can leave the buffer unchanged: (1) when a terminating 0-sized chunk is followed by trailer data without a CRLF, `substr()` receives `false` from `strpos()` which coerces to 0, leaving the buffer unchanged; (2) when exactly two non-CRLF bytes remain after a completed chunk, both the error guard (requiring `>2` bytes) and wait guard (requiring `<2` bytes) fail, causing the same state to re-process. A network attacker can send a crafted HTTP request or response containing `Transfer-Encoding: chunked` with malformed body structure (e.g., `0\r\nab` or `1\r\nAAB`). Since ReactPHP is single-threaded, the infinite loop blocks the event loop for all clients, causing complete denial of service. Applications using `React\Http\Browser` to fetch attacker-controlled URLs are affected even if behind a reverse proxy. Patch availability is not explicitly stated in the advisory. ## Affected products - ReactPHP HTTP