Next.js v15.5.23 Security Patch Released: ReplyServer Traversal Guards and What You Need to Know

Next.js Continues Its New Monthly Security Release Cadence with v15.5.23

Vercel has released Next.js v15.5.23 (August 7, 2026), the latest in a series of security-focused patches following the framework’s newly formalized monthly security release process. This patch ports critical ReplyServer traversal guards to FlightClient for the 15.x branch — a fix that closes a potential server-side traversal vulnerability in React Server Components communication.

What’s in v15.5.23?

The update contains a single but important security fix:

  • [15.x] Port ReplyServer traversal guards to FlightClient — This backports a traversal guard that prevents malicious payloads from traversing unexpected paths in the React Flight protocol’s client-side handler.

Context: Next.js’s New Formal Security Release Process

This patch is part of Next.js’s newly formalized security update cadence, announced in July 2026. The July 2026 Security Release (v16.2.11 / v15.5.21) was the first under this new process, addressing a total of 4 HIGH and 5 MEDIUM severity vulnerabilities, including:

  • HIGH: Denial of Service in App Router using Server Actions
  • HIGH: Middleware/Proxy bypass in App Router apps using Turbopack with single locale
  • HIGH: Server-Side Request Forgery (SSRF) in rewrites via attacker-controlled destination hostname
  • HIGH: SSRF in Server Actions on custom servers
  • MODERATE: Cache confusion of response bodies for requests with bodies
  • MODERATE: Cache confusion with invalid UTF-8 byte sequences
  • MODERATE: Denial of Service in the Image Optimization API using SVGs
  • MODERATE: Unauthenticated disclosure of internal Server Function endpoints
  • MODERATE: Unbounded Server Action payload in Edge runtime

Which Versions Are Affected?

Vercel maintains two active release lines:

  • Next.js 16.x (Active LTS) — Update to v16.3.0 (now stable) for the latest features and security fixes
  • Next.js 15.x (Maintenance LTS) — Update to v15.5.23 or later

Note: Next.js 15 reaches end of life on October 21, 2026. Teams still on 15.x should plan their upgrade to 16.x soon.

How to Update

# For Next.js 15.x users
npm install next@15.5.23

# For Next.js 16.x users (recommended)
npm install next@16.3.0

Key Takeaway for Developers

With Next.js now on a formal monthly security release schedule, teams should treat Next.js updates the same way they treat OS or browser security patches — apply them promptly. The combination of Server Actions, App Router, and Edge runtime creates a broad attack surface that requires ongoing vigilance.

If you’re still on Next.js 15.x, this is also a good reminder that the clock is ticking — EOL is October 21, 2026. Start planning your migration to Next.js 16.3 now to benefit from the 90% dev memory reduction, instant navigations, and continued security support.

Hashtags: #NextJS #WebSecurity #JavaScript #ReactJS #WebDevelopment #AppSecurity #NextJS16 #Vercel

Sources & Resources:

Search

Categories

Archives