Urgent: Next.js May 2026 Security Release Patches 13 Vulnerabilities — Update Immediately

Next.js Ships Coordinated Security Release Fixing 13 Critical Advisories

On May 7, 2026, Vercel released a major coordinated security patch for Next.js addressing 13 security advisories in a single release — the most comprehensive security update in the framework’s history. The patched versions are Next.js 15.5.18 and 16.2.6, along with React Server DOM packages 19.0.6, 19.1.7, and 19.2.6.

⚠️ Critical note: Vercel has explicitly stated that WAF rules will not protect against these vulnerabilities. Patching is the only complete mitigation.

What’s Covered in the 13 Advisories

🔴 Middleware & Authorization Bypass (High Severity)

Four CVEs directly undermine authentication and authorization in Next.js App Router applications:

  • CVE-2026-44575 — Auth bypass via App Router segment-prefetch URL: Specially crafted .rsc URLs bypass middleware rules entirely, allowing access to protected content without triggering authorization checks.
  • CVE-2026-44574 — Bypass via dynamic route parameter injection: Query parameter injection alters dynamic route values, hiding the actual request path from middleware.
  • CVE-2026-44573 — Pages Router i18n default-locale path bypasses proxy authorization: Locale-less /_next/data/ requests bypass middleware in apps using i18n configuration.
  • A fourth advisory addresses an incomplete fix from a previous release — if you already patched for an earlier middleware bypass, you need to patch again.

🔴 Denial of Service (High Severity)

  • CVE-2026-23870 — DoS in React Server Components (upstream React vulnerability): Crafted HTTP requests to any App Router Server Function endpoint can trigger excessive CPU usage. Requires no authentication.
  • CVE-2026-44579 — DoS via connection exhaustion in Cache Components: Malicious POST requests create a request-body deadlock that exhausts server file descriptors.
  • A third DoS path targets the Image Optimization API.

🔴 Server-Side Request Forgery — SSRF (Critical, Self-Hosted)

  • CVE-2026-44578 — SSRF via WebSocket upgrade: Unauthenticated attackers can force the server to proxy traffic to arbitrary internal or external destinations, potentially exposing cloud metadata endpoints. Primarily affects self-hosted Next.js deployments.

🟡 Cache Poisoning & XSS (Moderate Severity)

  • Cache poisoning in React Server Component responses
  • Cache poisoning via collisions in RSC cache-busting
  • XSS in App Router applications using CSP nonces
  • XSS in beforeInteractive scripts with untrusted input

Affected Versions & What to Upgrade To

Package Affected Upgrade To
Next.js 13.x, 14.x All versions 15.5.18 or 16.2.6
Next.js 15.x ≤ 15.5.17 15.5.18
Next.js 16.x ≤ 16.2.5 16.2.6
react-server-dom-* 19.0.x ≤ 19.0.5 19.0.6
react-server-dom-* 19.1.x ≤ 19.1.6 19.1.7
react-server-dom-* 19.2.x ≤ 19.2.5 19.2.6

How to Update Right Now

# Update to latest Next.js
npm install next@latest

# Or pin to specific patched versions:
npm install next@15.5.18  # for 15.x
npm install next@16.2.6   # for 16.x

# Update React server packages
npm install react@latest react-dom@latest

# For Next.js 16.1.0+, use the built-in upgrade command:
npx next upgrade

After upgrading, redeploy your application immediately. There is no workaround, no config change, and no WAF rule that replaces the patch.

Who Is NOT Affected

  • Pages Router apps — Not affected by RSC and App Router middleware bypass CVEs (but still worth upgrading for the i18n bypass fix)
  • Vercel-hosted apps — Protected from the SSRF vulnerability specifically, but still affected by middleware and DoS CVEs
  • Astro, Gatsby, and Remix apps — Not affected
  • Client-only React apps — Not affected (vulnerable code paths require server-side rendering)
  • Edge Runtime apps — Not affected by RSC vulnerabilities

The Bigger Picture: RSC Security Concerns

This is the sixth or seventh time in roughly six months that a serious vulnerability has been traced back to the React Server Components protocol. The RSC Flight protocol is a deserialization layer, and deserialization vulnerabilities have historically been persistent and hard to fully close. The December 2025 release fixed an incomplete patch from a previous advisory; this May 2026 release fixes another incomplete patch from January 2026.

Prominent React educator Kent C. Dodds has publicly stated he considers RSC to have been a mistake, citing the recurring security pattern. While RSC offers real benefits — reduced client bundle size, server-side data access, simpler data fetching — the security surface is still being hardened.

Bottom line: Run npm install next@latest and redeploy now.

Hashtags: #NextJS #ReactJS #WebSecurity #CVE #JavaScript #WebDevelopment #SecurityPatch #AppRouter

Sources:

Search

Categories

Archives