Executive brief
Next.js is a popular React framework used to build web applications with server and client-side rendering. A crafted HTTP request sent to a Server Function endpoint can cause the application server to consume excessive CPU, making it unresponsive to legitimate users and potentially causing application downtime.
Technical details
This vulnerability affects the deserialization of specially crafted requests in Next.js App Router Server Functions (React Server Components). The root cause is improper resource allocation during request processing (CWE-770), where no limits are enforced on CPU consumption during deserialization. The attack requires only network access to a Server Function endpoint and involves no authentication or user interaction. An attacker can repeatedly send malicious requests to exhaust server CPU and trigger denial of service. Fixes are available in Next.js 15.5.15 and 16.2.3, with the upstream React issue tracked as CVE-2026-23869.
Affected products
- Vercel Next.js 13.0.0 to 15.5.14, 16.0.0 to 16.2.2
Timeline
- 2026-04-08: disclosed
- 2026-04-10: patched: Patches released: Next.js 15.5.15 and 16.2.3