▲Vercel News•Stalecollected in 12h
Next.js May 2026 Security Release Patches 13 Vulns
💡13 critical Next.js/React vulns patched—upgrade now to block DoS, SSRF, XSS in your apps!
⚡ 30-Second TL;DR
What Changed
Addresses 13 vulns: auth bypass in App Router, DoS in RSCs (CVE-2026-23870), SSRF in WebSockets
Why It Matters
High-severity issues like auth bypass and DoS expose apps to attacks; affects caching, WebSockets, and more. Vercel apps and frameworks using react-server-dom-* are vulnerable until patched.
What To Do Next
Upgrade Next.js to 16.2.6 or 15.5.18 and React to 19.2.6 immediately via npm.
Who should care:Developers & AI Engineers
Key Points
- •Addresses 13 vulns: auth bypass in App Router, DoS in RSCs (CVE-2026-23870), SSRF in WebSockets
- •Impacts middleware.js, proxy.js, Server Functions, Partial Prerendering, Image API, CSP nonces
- •Patched: Next.js 15.5.18/16.2.6, React 19.0.6/19.1.7/19.2.6, react-server-dom-* packages
- •No WAF rules; upgrade only fix for all Next.js 13.x-16.x users
🧠 Deep Insight
AI-generated analysis for this event.
🔑 Enhanced Key Takeaways
- •The vulnerability CVE-2026-23870 in React Server Components specifically exploits improper sanitization of serialized payload streams, allowing attackers to trigger resource exhaustion via deeply nested component trees.
- •Security researchers noted that the SSRF vulnerability in the WebSockets implementation was introduced during the refactoring of the Next.js edge runtime networking stack in version 15.4.0.
- •The coordinated release was managed through the GitHub Security Advisory (GHSA) program, with Vercel working alongside major cloud providers to ensure infrastructure-level mitigations were ready for users unable to perform immediate application-level deployments.
📊 Competitor Analysis▸ Show
| Feature | Next.js | Remix (React Router) | Nuxt.js | Astro |
|---|---|---|---|---|
| Security Patching | Coordinated/Centralized | Community-driven | Community-driven | Community-driven |
| SSR/RSC Model | Native/Integrated | Hybrid/Adapter-based | Hybrid | Island Architecture |
| Deployment | Vercel-optimized | Agnostic | Agnostic | Agnostic |
| Vulnerability History | High-frequency/High-visibility | Moderate | Moderate | Moderate |
🛠️ Technical Deep Dive
- CVE-2026-23870 (RSC DoS): The flaw exists in the
react-server-dom-webpackparser, where recursive object deserialization lacks depth-limiting checks, leading to stack overflow errors when processing malicious RSC payloads. - Middleware/Proxy Bypass: The vulnerability stems from a normalization discrepancy between the
next-middlewareruntime and the underlying Node.jshttpmodule, where specifically crafted URL-encoded characters (e.g.,%2e%2e%2f) were incorrectly decoded after the middleware security check. - SSRF in WebSockets: The issue was traced to the
next/serverWebSocket proxy handler, which failed to validate theHostheader against an allowlist when forwarding upgrade requests to internal microservices.
🔮 Future ImplicationsAI analysis grounded in cited sources
Next.js will implement mandatory automated security scanning for RSC payloads in the next major version.
The severity of CVE-2026-23870 necessitates a shift from manual validation to framework-level automated sanitization to prevent similar DoS vectors.
Vercel will introduce a 'Security-First' release track for enterprise customers.
The complexity of managing 13 simultaneous advisories highlights the need for a more stable, long-term support (LTS) release cadence for mission-critical applications.
⏳ Timeline
2022-10
Next.js 13 introduces the App Router and React Server Components.
2024-02
Next.js 14.1 releases with significant improvements to the caching and revalidation engine.
2024-10
Next.js 15 stable release launches with React 19 support.
2026-05
Coordinated security release patches 13 vulnerabilities across Next.js 15.x and 16.x.
📰
Weekly AI Recap
Read this week's curated digest of top AI events →
👉Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: Vercel News ↗