highclosedpatched
React Server Components DoS CVE-2026-23869 (April Next.js advisory)
› Next.js App Router / React Server Components
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Apr 8, 2026
- closed
- Apr 8, 2026
- CVEs
- 1
- sources
- 1
## summary
April 8 2026 Next.js advisory GHSA-q4gf-8mx6-v5v3 tracks upstream CVE-2026-23869: crafted requests to App Router Server Function endpoints can cause excessive CPU / DoS. Patched in Next.js 15.5.15 and 16.2.3.
severity: High (CVSS 7.5)
## cve ids[1]
## affected
- Next.js >=13.0.0 <15.5.15 and >=16.0 <16.2.3
## fixed in
- 15.5.15
- 16.2.3
## advisories[1]
## notes & caveats
Verify primary vendor advisory for exact fixed versions; facts taken from public sources listed in links.
