Next.js May 2026 security release
By Steven Van ·
The release fixes 13 advisories, including CVE-2026-23870, with patches for Next.js 15.5.18, 16.2.6, and matching React releases.
Vercel has shipped a coordinated Next.js security release covering 13 advisories, including a denial-of-service issue in React Server Components tracked upstream as CVE-2026-23870.
The advisories fall into five categories:
- Middleware and proxy bypass: five issues, including auth bypass via an App Router segment-prefetch URL, a Pages Router i18n default-locale bypass, and dynamic route parameter injection, affecting apps that rely on middleware.js or proxy.js for authorization.
- Denial of service: three issues, including the React Server Components bug (CVE-2026-23870), connection exhaustion in apps using Cache Components, and a DoS via the Image Optimization API.
- Server-side request forgery: one issue affecting apps that handle WebSocket upgrade requests.
- Cache poisoning: two issues affecting apps with caching layers in front of React Server Component responses.
- Cross-site scripting: two issues affecting App Router apps using CSP nonces, or beforeInteractive scripts that consume untrusted input.
Patched releases are available for both Next.js and React. Apps on 13.x or 14.x should move to 15.5.18 or 16.2.6; 15.5.x upgrades to 15.5.18 and 16.2.x upgrades to 16.2.6. The react-server-dom-* packages are fixed in 19.0.6, 19.1.7 and 19.2.6 for React 19.0.x, 19.1.x and 19.2.x respectively. Vercel says it has not deployed new WAF rules for this release, as the advisories cannot be reliably blocked at the WAF layer, and that patching is the only complete mitigation. See the full advisory for version details.
