Security15.5.18, 16.2.6May 7, 2026

Next.js May 2026 security release

A coordinated security release addressing 13 critical and moderate vulnerabilities including denial of service, middleware and proxy bypass, server-side request forgery, cache poisoning, and cross-site scripting across Next.js and React. All affected users should upgrade immediately to the patched versions.

Summary

We have shipped a coordinated security release for Next.js addressing 13 advisories across denial of service, middleware and proxy bypass, server-side request forgery, cache poisoning, and cross-site scripting. One advisory addresses an upstream React Server Components vulnerability tracked as . CVE-2026-23870

Patched versions are available for both React and Next.js, and all should upgrade immediately.affected users

The release addresses the following advisories:

Affects applications that rely on or for authorization.middleware.jsproxy.js

Affects applications using Server Functions, Partial Prerendering with Cache Components, or the Image Optimization API.

Affects applications that handle WebSocket upgrade requests.

Affects applications with caching layers in front of React Server Component responses.

Affects applications using CSP nonces in App Router, or scripts that consume untrusted input.beforeInteractive

These vulnerabilities are addressed by the patched releases of React and Next.js. Patching is the only complete mitigation, and all should upgrade immediately. affected users

Vercel has not deployed new WAF rules for this release; these advisories cannot be reliably blocked at the WAF layer.

Frameworks and bundlers using packages should install the latest versions provided by their respective maintainers.react-server-dom-*

Middleware and proxy bypass

Denial of service

Server-side request forgery

Cache poisoning

Cross-site scripting

Impact

Resolution

Affected versions

Fixed in

References

: HighAuth bypass via App Router segment-prefetch URL
: HighApp Router segment-prefetch bypass, incomplete fix follow-up
: HighPages Router i18n default-locale path bypasses proxy authorization
: HighBypass via dynamic route parameter injection
: LowMiddleware redirects can be cache-poisoned

: (tracked upstream as )HighDoS in React Server Components CVE-2026-23870
: HighDoS via connection exhaustion in applications using Cache Components
: ModerateDoS via the Image Optimization API

: HighSSRF in applications using WebSocket upgrades

: ModerateCache poisoning in React Server Component responses
: LowCache poisoning via collisions in RSC cache-busting

: ModerateXSS in App Router applications using CSP nonces
: ModerateXSS in beforeInteractive scripts with untrusted input

: , Next.js15.5.1816.2.6
: , , for the , and packagesReact19.0.619.1.719.2.6react-server-dom-parcelreact-server-dom-webpackreact-server-dom-turbopack

Upstream React advisory (CVE-2026-23870)

Package	Affected	Upgrade to
, Next.js `13.x14.x`	`all versions`	or `15.5.1816.2.6`
Next.js `15.x`	`<=15.5.17`	`15.5.18`
Next.js `16.x`	`<=16.2.5`	`16.2.6`
react-server-dom-*`19.0.x`	`<=19.0.5`	`19.0.6`
react-server-dom-*`19.1.x`	`<=19.1.6`	`19.1.7`
react-server-dom-*`19.2.x`	`<=19.2.5`	`19.2.6`

securitynextjsreactvulnerabilitydenial-of-servicexss

Source: original entry ↗