Executive brief
Next.js is a popular web framework used to build server-rendered React applications. When using React Server Components with App Router, the framework deserializes untrusted HTTP requests sent to Server Function endpoints without proper validation. An attacker can send specially crafted requests to trigger excessive CPU consumption, out-of-memory errors, or server crashes, causing service outages and making the application unavailable to legitimate users.
Technical details
This vulnerability exists in the HTTP request deserialization logic used by React Server Components (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack) and Next.js when the App Router is enabled. The root cause is incomplete validation of deserialized data, allowing attackers to send specially crafted payloads to Server Function endpoints without authentication or user interaction. Exploitation can lead to uncontrolled resource consumption (excessive CPU usage or memory exhaustion) and denial of service. The attack vector is network-accessible and requires no privileges. Patches are available across multiple affected versions: React Server DOM packages 19.0.4, 19.1.5, 19.2.4 and Next.js 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5.
Affected products
- Vercel Next.js 13.0.0 to 15.0.7, 15.0.0 to 15.6.0-canary.60, 16.0.0 to 16.1.4
- Meta react-server-dom-webpack 19.0.0 to 19.0.3, 19.1.0 to 19.1.4, 19.2.0 to 19.2.3
- Meta react-server-dom-parcel 19.0.0 to 19.0.3, 19.1.0 to 19.1.4, 19.2.0 to 19.2.3
- Meta react-server-dom-turbopack 19.0.0 to 19.0.3, 19.1.0 to 19.1.4, 19.2.0 to 19.2.3
Timeline
- 2026-01-28: disclosed: Vulnerability disclosed in GitHub Security Advisories
- 2026-01-28: patched: Patches released for affected versions