Summary of CVE-2026-23869
By Steven Van ·
Vercel's WAF now blocks a CVE-2026-23869 exploit automatically, but it still recommends upgrading to Next.js 15.5.15 or 16.2.3.
Vercel has deployed new Web Application Firewall rules to automatically protect all hosted projects against CVE-2026-23869, a high-severity (CVSS 7.5) denial-of-service vulnerability in React Server Components. A specially crafted HTTP request to any App Router Server Function endpoint can trigger excessive CPU usage during deserialization, affecting Next.js 13.x, 14.x, 15.x and 16.x.
The WAF mitigation is free and automatic for projects on Vercel, but the company says it should not be relied on for full protection and that immediate upgrades are still required. Fixes are included in Next.js 15.5.15 and 16.2.3. Full details are in the original advisory.
