Next.js May 2026 security release
A coordinated security release addressing 13 critical and moderate vulnerabilities including denial of service, middleware and proxy bypass, server-side request forgery, cache poisoning, and cross-site scripting across Next.js and React. All affected users should upgrade immediately to the patched versions.
We have shipped a coordinated security release for Next.js addressing 13 advisories across denial of service, middleware and proxy bypass, server-side request forgery, cache poisoning, and cross-site scripting. One advisory addresses an upstream React Server Components vulnerability tracked as . CVE-2026-23870
Patched versions are available for both React and Next.js, and all should upgrade immediately.affected users
The release addresses the following advisories:
Affects applications that rely on or for authorization.middleware.jsproxy.js
Affects applications using Server Functions, Partial Prerendering with Cache Components, or the Image Optimization API.
Affects applications that handle WebSocket upgrade requests.
Affects applications with caching layers in front of React Server Component responses.
Affects applications using CSP nonces in App Router, or scripts that consume untrusted input.beforeInteractive
These vulnerabilities are addressed by the patched releases of React and Next.js. Patching is the only complete mitigation, and all should upgrade immediately. affected users
Vercel has not deployed new WAF rules for this release; these advisories cannot be reliably blocked at the WAF layer.
Frameworks and bundlers using packages should install the latest versions provided by their respective maintainers.react-server-dom-*
Recommended actions
Middleware and proxy bypass
Denial of service
Server-side request forgery
Cache poisoning
Cross-site scripting
Impact
Resolution
Affected versions
Fixed in
References
: HighApp Router segment-prefetch bypass, incomplete fix follow-up
: HighPages Router i18n default-locale path bypasses proxy authorization
: (tracked upstream as )HighDoS in React Server ComponentsCVE-2026-23870
: HighDoS via connection exhaustion in applications using Cache Components
: ModerateDoS via the Image Optimization API
: , , for the , and packagesReact
19.0.619.1.719.2.6react-server-dom-parcelreact-server-dom-webpackreact-server-dom-turbopack
Package | Affected | Upgrade to |
|---|---|---|
, Next.js |
| or |
Next.js |
|
|
Next.js |
|
|
react-server-dom-* |
|
|
react-server-dom-* |
|
|
react-server-dom-* |
|
|
Source: original entry ↗
More from Vercel
Follow Vercel to get its new changes in your feed and email digest.
OpenAI Decisions API now available on AI Gateway
OpenAI's Decisions API is now accessible through Vercel's AI Gateway with an OpenAI-compatible endpoint, enabling decision models to answer typed questions and return probabilities, choices, and scores for routing, triage, and guardrails use cases. Support is available across the OpenAI SDK, AI SDK, HTTP API, and CLI with the latest versions.
Timestamp attributes now supported in Vercel Flags
Vercel Flags now supports timestamp attributes for entities, allowing you to create time-based targeting rules. Use this feature to run limited-time campaigns, show content between specific dates, or target users based on registration date.
Glyph Cluster now available in stealth on AI Gateway
Glyph Cluster, a reasoning model for coding and long-context analysis, is now available as a stealth model on Vercel's AI Gateway for Pro and Enterprise plan teams with purchased AI Gateway credits at no cost during the stealth period. The model supports function calling, streams responses, and can be accessed via AI SDK, OpenAI-compatible APIs, and coding agents.