Next.js Vulnerable to Denial of Service with Server Components

GHSA-8h8q-6873-q5fj

Published May 11, 2026 · Modified May 13, 2026

Description

A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.

References

WEB https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh
WEB https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj
WEB https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-w94c-4vhp-22gx
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23870
PACKAGE https://github.com/vercel/next.js

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes