
Next.js May 2026 Security Release Patches 13 Vulns
Next.js shipped a coordinated security release addressing 13 advisories including DoS, middleware/proxy bypass, SSRF, cache poisoning, and XSS. One stems from upstream React Server Components (CVE-2026-23870). All affected users must upgrade immediately as patching is the sole mitigation.







