Executive brief
Next.js is a popular React framework used to build web applications. A vulnerability in Server Components allows attackers to send specially crafted requests that trigger excessive CPU usage, causing the application to become unresponsive and denying service to legitimate users. This affects Next.js versions 13 through 15 and 16 when using the App Router.
Technical details
The vulnerability exists in React Server Components deserialization logic (tracked upstream as CVE-2026-23870) and affects Next.js 13.x–15.x and 16.x using the App Router. A specially crafted HTTP request sent to any App Router Server Function endpoint triggers excessive CPU consumption during deserialization, resulting in denial of service. The root cause is improper resource consumption controls (CWE-770). Attack vector is network-based with no authentication or user interaction required. Patches are available: Next.js 15.5.16 and 16.2.5 or later, or upgrading to fixed versions of react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack (19.0.6, 19.1.7, 19.2.6 respectively).
Affected products
- Vercel Next.js 13.0.0 to 15.5.15, 16.0.0 to 16.2.4
- Meta react-server-dom-webpack 19.0.0 to 19.0.5, 19.1.0 to 19.1.6, 19.2.0 to 19.2.5
- Meta react-server-dom-parcel 19.0.0 to 19.0.5, 19.1.0 to 19.1.6, 19.2.0 to 19.2.5
- Meta react-server-dom-turbopack 19.0.0 to 19.0.5, 19.1.0 to 19.1.6, 19.2.0 to 19.2.5
Timeline
- 2026-05-06: disclosed
- 2026-05-06: patched: Patches released: Next.js 15.5.16, 16.2.5; React server-dom packages 19.0.6, 19.1.7, 19.2.6