highclosedpatched
Next.js / React Server Components May 2026 security release
› Next.js; react-server-dom-webpack/parcel/turbopack
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- May 6, 2026
- closed
- May 7, 2026
- CVEs
- 1
- sources
- 3
## summary
Coordinated May 6–7 2026 security release for React Server Components (CVE-2026-23870 DoS) and multiple Next.js advisories spanning middleware/proxy bypass, XSS, SSRF, cache poisoning and DoS. Upgrade Next.js to 15.5.18 or 16.2.6; react-server-dom-* to 19.0.6 / 19.1.7 / 19.2.6. Next.js 13.x/14.x had no planned patches.
severity: High (CVSS 7.5 for CVE-2026-23870) plus additional Next.js advisories
## cve ids[1]
## affected
- Next.js 13.x–16.x App Router (see advisory tables); RSC packages 19.0.0–19.0.5, 19.1.0–19.1.6, 19.2.0–19.2.5
## fixed in
- Next.js 15.5.18
- Next.js 16.2.6
- react-server-dom-* 19.0.6 / 19.1.7 / 19.2.6
## advisories[2]
## news & write-ups[1]
## notes & caveats
Earlier April advisory GHSA-q4gf-8mx6-v5v3 / CVE-2026-23869 is a related prior RSC DoS — not duplicated as a separate row.
