Multiple Critical Vulnerabilities Patched in Next.js and React Server Components

Cybersecuritynews •Guru Baran • May 8, 2026

Vercel has released an extensive set of security advisories for .js, addressing more than a dozen vulnerabilities, including denial-of-service, middleware bypass, server-side request forgery, and cross-site scripting. The flaws affect .js versions 13.x through 16.x using the App Router, as well as React Server Components packages for versions 19.x. CVE-2026-23870: Denial of Service via React […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in React and Next.js Require Immediate Updates Multiple critical vulnerabilities affecting React Server Components and .js have been disclosed, including denial of service, server-side request forgery, and middleware bypass issues. These flaws impact versions 13.x to 16.x of .js and 19.x of React Server Components. Vercel has released patches for these vulnerabilities, with CVE-2026-23870 published on 2026-05-06. Cloudflare has deployed WAF rules to mitigate some of the newly disclosed vulnerabilities but recommends that users update their applications directly. The vulnerabilities pose significant risks, including potential unauthorized access and service disruptions. Security professionals are urged to apply the updates immediately to protect their applications from exploitation. The vulnerabilities were disclosed with minimal advance notice, emphasizing the urgency of the situation. 5 sources 72

Extracted Entities

Multiple Critical Vulnerabilities Patched in Next.js and React Server Components

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (3)

Vulnerabilities (1)