Loading story…
Vercel has released a broad set of security fixes for Next.js and related React Server Components, addressing more than a dozen vulnerabilities affecting App Router deployments across versions 13.x through 16.x and React Server Components 19.x. The disclosures include denial of service, server-side request forgery, cross-site scripting, cache poisoning, and multiple middleware authorization bypass conditions. Among the most serious issues is CVE-2026-23870 (GHSA-8h8q-6873-q5fj), a high-severity denial-of-service flaw in React Flight deserialization that can be triggered through crafted requests to App Router Server Function endpoints, causing excessive CPU consumption; fixes were issued in Next.js 15.5.16 and 16.2.5. Vercel also disclosed CVE-2026-44578, a high-severity SSRF issue in self-hosted Node.js deployments via crafted WebSocket upgrade requests.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Vercel disclosed more than a dozen vulnerabilities affecting Next.js and related React Server Components, including middleware authorization bypass, SSRF, XSS, cache poisoning, and additional DoS issues. The advisories covered affected versions across Next.js 13.x through 16.x and React Server Components 19.x, with upgrade and mitigation guidance for users.
Vercel published a security advisory for CVE-2026-23870 / GHSA-8h8q-6873-q5fj, a denial-of-service issue in App Router deployments using vulnerable React Server Components packages. The company said crafted requests to Server Function endpoints could cause excessive CPU consumption and released fixes in Next.js 15.5.16 and 16.2.5.
Through April 2025, more GitHub projects released exploit code, scanners, and simulation environments for CVE-2025-29927. These references show broader public weaponization and testing support for the middleware bypass vulnerability.
Multiple GitHub repositories published proof-of-concept material for CVE-2025-29927, a Next.js middleware authorization bypass issue. The PoCs describe bypassing protections in Next.js middleware, including abuse of the x-middleware-subrequest header.
A GitHub repository published a Nuclei template for CVE-2025-29927, indicating public detection guidance for the Next.js middleware authorization bypass vulnerability. This is the earliest reference in the provided material tied to the flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
23 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcecybersecuritynews.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Vercel issued a coordinated Next.js security release covering 13 advisories, including a high-severity server-side request forgery flaw tracked as **CVE-2026-44578** / `GHSA-c4j6-fc7j-m34r`. The bug affects self-hosted applications using the built-in Node.js server, where crafted WebSocket upgrade requests can be abused to proxy traffic to arbitrary internal or external destinations. That exposure can let attackers reach cloud metadata endpoints, internal admin interfaces, and other internal services, potentially stealing cloud credentials, API keys, and deployment secrets. Vercel-hosted deployments were reported as unaffected because they do not use the vulnerable WebSocket routing path. The release also fixed an App Router authorization bypass, `GHSA-267c-6grr-h53f`, in which specially crafted `.rsc` and segment-prefetch URLs could evade middleware or proxy-based access controls and expose protected content. A public GitHub repository has since collected proof-of-concept material for 12 issues fixed in `next` 16.2.5, including SSRF, middleware bypass, cache poisoning, XSS, and denial-of-service bugs, increasing the urgency for defenders to patch. Vercel said patching is the only complete mitigation and advised upgrading to **Next.js** `15.5.18` or `16.2.6`, with immediate interim steps including blocking unnecessary WebSocket upgrades, restricting origin-server egress to metadata and internal networks, and enforcing authorization checks in route or page logic rather than relying solely on middleware.
Jun 29, 2026
Vercel has patched three high-severity vulnerabilities in **Next.js** that could allow **server-side request forgery (SSRF)** and, in a narrower configuration, bypass middleware-based authentication. The flaws are tracked as `CVE-2026-64645`, `CVE-2026-64649`, and `CVE-2026-64642`, each rated **CVSS 8.3**, and affect multiple supported branches of the framework. According to the advisory coverage, the SSRF issues can be triggered under specific configurations, while the authentication bypass affects deployments using the **App Router** and **Turbopack** in a limited scenario. The issues were fixed in **Next.js 16.2.11** and **15.5.21**, with no public proof-of-concept or confirmed in-the-wild exploitation reported at publication time. Defenders are advised to upgrade promptly, avoid user-controlled external destination hostnames, validate `Host` and `X-Forwarded-Host` headers, and enforce authorization checks in server-side page logic rather than relying solely on middleware protections.
Jul 23, 2026
Multiple vulnerabilities were disclosed in the widely used React Router `npm` package, including a reported remote code execution issue tracked as **CVE-2026-42211** that researchers said could allow unauthenticated attackers to gain shell access when chained with an existing prototype pollution weakness. Additional flaws include **CVE-2026-33245**, a client-side cross-site scripting bug in redirect handling for applications using unstable React Server Components APIs, plus **CVE-2026-34077** and **CVE-2026-42342**, two denial-of-service issues tied to serialization and manifest endpoint performance that can crash or degrade backend services. The XSS issue affects React Router versions `7.7.0` through `7.13.1` when redirects originate from untrusted sources and use `javascript:` targets; applications not using the unstable RSC APIs or running in standard Declarative Mode are not impacted. Maintainers patched **CVE-2026-33245** in React Router `7.13.2`, while broader mitigation for the full set of reported issues requires upgrading to React Router `7.15.0` or Remix `2.17.5`.
Jun 29, 2026