A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

PKSA-7xc4-r5ry-fg9s CVE-2026-84997

Affected package: react/http

Affected version: >=0.6.0,<1.11.1

Reported by:
FriendsOfPHP/security-advisories