# Next\.js May 2026 security release

**Published:** May 7, 2026 | **Authors:** Jimmy Lai

---

# Summary

We have shipped a coordinated security release for Next.js addressing 13 advisories across denial of service, middleware and proxy bypass, server-side request forgery, cache poisoning, and cross-site scripting. One advisory addresses an upstream React Server Components vulnerability tracked as [CVE-2026-23870](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh).

### Recommended actions

Patched versions are available for both React and Next.js, and all [affected users](#affected-versions) should upgrade immediately.

## Impact

The release addresses the following advisories:

### Middleware and proxy bypass

Affects applications that rely on `middleware.js` or `proxy.js` for authorization.

- **High**: [Auth bypass via App Router segment-prefetch URL](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f)
- **High**: [App Router segment-prefetch bypass, incomplete fix follow-up](https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6)
- **High**: [Pages Router i18n default-locale path bypasses proxy authorization](https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5)
- **High**: [Bypass via dynamic route parameter injection](https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv)
- **Low**: [Middleware redirects can be cache-poisoned](https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq)

### **Denial of service**

Affects applications using Server Functions, Partial Prerendering with Cache Components, or the Image Optimization API.

- **High**: [DoS in React Server Components](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj) (tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh))
- **High**: [DoS via connection exhaustion in applications using Cache Components](https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx)
- **Moderate**: [DoS via the Image Optimization API](https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh)

### **Server-side request forgery**

Affects applications that handle WebSocket upgrade requests.

- **High**: [SSRF in applications using WebSocket upgrades](https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r)

### **Cache poisoning**

Affects applications with caching layers in front of React Server Component responses.

- **Moderate**: [Cache poisoning in React Server Component responses](https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7)
- **Low**: [Cache poisoning via collisions in RSC cache-busting](https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949)

### **Cross-site scripting**

Affects applications using CSP nonces in App Router, or `beforeInteractive` scripts that consume untrusted input.

- **Moderate**: [XSS in App Router applications using CSP nonces](https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q)
- **Moderate**: [XSS in beforeInteractive scripts with untrusted input](https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h)

## Resolution

These vulnerabilities are addressed by the patched releases of React and Next.js. Patching is the only complete mitigation, and all [affected users](#affected-versions) should upgrade immediately.

Vercel has not deployed new WAF rules for this release; these advisories cannot be reliably blocked at the WAF layer.

## Affected versions

| Package | Affected | Upgrade to |
| --- | --- | --- |
| **Next.js **`13.x`, `14.x` | `all versions` | `15.5.18` or `16.2.6` |
| **Next.js **`15.x` | `<=15.5.17` | `15.5.18` |
| **Next.js **`16.x ` | `<=16.2.5` | `16.2.6` |
| **react-server-dom-*** `19.0.x` | `<=19.0.5` | `19.0.6` |
| **react-server-dom-*** `19.1.x` | `<=19.1.6` | `19.1.7` |
| **react-server-dom-*** `19.2.x` | `<=19.2.5` | `19.2.6` |

## Fixed in

- **Next.js**: [`15.5.18`](https://github.com/vercel/next.js/releases/tag/v15.5.18), [`16.2.6`](https://github.com/vercel/next.js/releases/tag/v16.2.6)
- **React**: [`19.0.6`](https://github.com/facebook/react/releases/tag/v19.0.6), [`19.1.7`](https://github.com/facebook/react/releases/tag/v19.1.7), [`19.2.6`](https://github.com/facebook/react/releases/tag/v19.2.6) for the `react-server-dom-parcel`, `react-server-dom-webpack` and `react-server-dom-turbopack` packages

Frameworks and bundlers using `react-server-dom-*` packages should install the latest versions provided by their respective maintainers.

## References

- [Upstream React advisory (CVE-2026-23870)](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh)

---

📚 **More updates:** [View all changelog entries](/changelog/sitemap.md) | [Blog](/blog/sitemap.md)