# Next.js HTTP request deserialization denial of service in Server Components

Source: https://junglewise.ai/threats/next-js-http-request-deserialization-denial-of-service-in-server-63dde111  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-01-28

Next.js is a popular web framework used to build server-rendered React applications. When using React Server Components with App Router, the framework deserializes untrusted HTTP requests sent to Server Function endpoints without proper validation. An attacker can send specially crafted requests to trigger excessive CPU consumption, out-of-memory errors, or server crashes, causing service outages and making the application unavailable to legitimate users.

Technologies: [Vercel Next.js](https://junglewise.ai/threats/technologies/next-js). Vendors: [Vercel](https://junglewise.ai/threats/vendors/vercel).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 28 January 2026.

**Which products and versions are affected?** Vercel Next.js 13.0.0 to 15.0.7, 15.0.0 to 15.6.0-canary.60, 16.0.0 to 16.1.4.

**Is there a fix for This vulnerability?** A patch was published on 2026-01-28: Patches released for affected versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether you run Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability exists in the HTTP request deserialization logic used by React Server Components (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack) and Next.js when the App Router is enabled. The root cause is incomplete validation of deserialized data, allowing attackers to send specially crafted payloads to Server Function endpoints without authentication or user interaction. Exploitation can lead to uncontrolled resource consumption (excessive CPU usage or memory exhaustion) and denial of service. The attack vector is network-accessible and requires no privileges. Patches are available across multiple affected versions: React Server DOM packages 19.0.4, 19.1.5, 19.2.4 and Next.js 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5.

## Affected products

- Vercel Next.js 13.0.0 to 15.0.7, 15.0.0 to 15.6.0-canary.60, 16.0.0 to 16.1.4
- Meta react-server-dom-webpack 19.0.0 to 19.0.3, 19.1.0 to 19.1.4, 19.2.0 to 19.2.3
- Meta react-server-dom-parcel 19.0.0 to 19.0.3, 19.1.0 to 19.1.4, 19.2.0 to 19.2.3
- Meta react-server-dom-turbopack 19.0.0 to 19.0.3, 19.1.0 to 19.1.4, 19.2.0 to 19.2.3

## Timeline

- 2026-01-28: disclosed: Vulnerability disclosed in GitHub Security Advisories
- 2026-01-28: patched: Patches released for affected versions

## References

- [https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg)
- [https://github.com/vercel/next.js/security/advisories/GHSA-h25m-26qc-wcjf](https://github.com/vercel/next.js/security/advisories/GHSA-h25m-26qc-wcjf)

## Related threats

- [Vercel Next.js remote code execution in use cache functions](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3)
- [Next.js denial of service in App Router with Server Actions](https://junglewise.ai/threats/cve-2026-94482-next-js-denial-of-service-in-app-router-using-server-actions)
- [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87)
- [Next.js information disclosure in Draft Mode via use cache](https://junglewise.ai/threats/cve-2026-94544-next-js-is-a-react-framework-for-building-full-stack-web)
- [Next.js Pages Router response cache key bypass](https://junglewise.ai/threats/cve-2026-94543-next-js-is-a-react-framework-for-building-full-stack-web)