{"action":"Upgrade react/http to 1.11.1 or later.","affected":[{"fixed":"1.11.1","introduced":"1.0.0"}],"component":"react/http","cve_ids":["CVE-2026-104827"],"ecosystem":"Packagist","exploited":false,"fixed_versions":["1.11.1"],"ghsa_id":"GHSA-g4f2-2pf3-2pwj","id":"tcs_01M5JHGB3Y47953TPWQKGW61DB","modified_at":"2026-10-15T20:30:06.075181740Z","published_at":"2026-10-15T20:09:56Z","references":["https://osv.dev/vulnerability/GHSA-g4f2-2pf3-2pwj","https://github.com/reactphp/http/security/advisories/GHSA-g4f2-2pf3-2pwj","https://github.com/reactphp/http/commit/2558622d0b76227c60c61eac8a61572cb6638e8c","https://github.com/reactphp/http","https://github.com/reactphp/http/releases/tag/v1.11.1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-g4f2-2pf3-2pwj","url":"https://osv.dev/vulnerability/GHSA-g4f2-2pf3-2pwj"}],"summary":"react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS"}