Developers.Cloudflare Critical Vulnerabilities in React and Next.js Require Immediate Updates
Article Content
- •Vulnerabilities affect React and .js versions 13.x to 16.x and 19.x respectively.
- •Critical flaws include denial of service, SSRF, and middleware bypass vulnerabilities.
- •Immediate updates are recommended as Cloudflare's WAF may not block all attack vectors.
Multiple critical vulnerabilities affecting React Server Components and .js have been disclosed, including denial of service, server-side request forgery, and middleware bypass issues. These flaws impact versions 13.x to 16.x of .js and 19.x of React Server Components. Vercel has released patches for these vulnerabilities, with CVE-2026-23870 published on 2026-05-06. Cloudflare has deployed WAF rules to mitigate some of the newly disclosed vulnerabilities but recommends that users update their applications directly. The vulnerabilities pose significant risks, including potential unauthorized access and service disruptions. Security professionals are urged to apply the updates immediately to protect their applications from exploitation. The vulnerabilities were disclosed with minimal advance notice, emphasizing the urgency of the situation.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (10)
Following this threat?
Track Vercel and CVE-2025-55184 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Langflow AI Platform Targeted by RCE Exploitation In September 2026, the Langflow AI application-building platform faced significant exploitation attempts targeting CVE-2026-0768, an unauthenticated remote code execution vulnerability. F5 Labs reported 405 requests from 55 distinct source IPs, indicating a coordinated effort to exploit this flaw. The vulnerability…