Vercel Ships Coordinated Next.js Security Release Patching 13 Advisories Across DoS, Middleware Bypass, SSRF and Cache Poisoning
Next.js 15.5.18 and 16.2.6 land with a 13-advisory bundle covering a React Server Components DoS (CVE-2026-23870), middleware-bypass routes, SSRF, and cache poisoning; Vercel says the WAF cannot reliably block them.
Overview
Vercel published a coordinated security release for Next.js on May 7, 2026, bundling fixes for what the company describes as “13 advisories across denial of service, middleware and proxy bypass, server-side request forgery, cache poisoning, and cross-site scripting”. The patched versions are Next.js 15.5.18 and 16.2.6, and Vercel told users that “all affected users should upgrade immediately”. The release is unusual in scope for the framework — most prior Next.js advisories have shipped one or two at a time — and it pairs with an upstream React Server Components patch tracked as CVE-2026-23870.
Vercel also said it would not be adding new managed rules for the batch. The changelog states bluntly that “Vercel has not deployed new WAF rules for this release; these advisories cannot be reliably blocked at the WAF layer” — an admission that customers running self-hosted or third-party-hosted Next.js cannot rely on edge filtering as a stopgap.
What We Know
Scope and timing
According to Netlify’s framework-host write-up, “The Next.js and React teams have disclosed twelve security vulnerabilities: one in React Server Components and eleven in Next.js, all patched on May 6, 2026, plus a follow-up advisory on May 7.” Vercel’s own count of 13 reflects the additional follow-up entry for a middleware-bypass fix that landed a day later.
The ten Next.js advisories visible on GitHub’s security advisory page for the project carry GHSA identifiers but no CVE numbers as of publication. The High-severity entries include GHSA-267c-6grr-h53f (“Middleware / Proxy bypass in App Router applications via segment-prefetch routes”), its follow-up GHSA-26hh-7cqf-hhc6 (“Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up”), GHSA-492v-c6pp-mqqv (“Middleware / Proxy bypass through dynamic route parameter injection”), GHSA-c4j6-fc7j-m34r (“Server-side request forgery in applications using WebSocket upgrades”), and GHSA-mg66-mrh9-m8jx (“Denial of Service via connection exhaustion in applications using Cache Components”), per the GitHub Security Advisories listing. Moderate-severity entries cover an Image Optimization API DoS (GHSA-h64f-5h5j-jqjh), two cross-site-scripting paths (GHSA-ffhc-5mcf-pf4q for CSP-nonce App Router apps and GHSA-gx5p-jg67-6x7h for beforeInteractive scripts with untrusted input), and an RSC response cache-poisoning issue (GHSA-wfc6-r584-vfw7). One Low-severity entry, GHSA-vfv6-92ff-j949, covers cache poisoning via collisions in React Server Component cache-busting.
The upstream React bug
The React Server Components vulnerability, CVE-2026-23870, is a denial-of-service flaw in the Flight-protocol deserializer that ships in three packages: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, according to Imperva. The root cause, Imperva’s writeup explains, is “improper handling of cyclic or recursively referenced data structures during request deserialization”. Imperva describes the attack as low-bandwidth and application-layer: “An attacker can send a specially crafted HTTP request to exposed Server Function endpoints in applications using React Server Components. When the payload is processed, the server enters a high-CPU execution state that can persist for extended periods before eventually throwing an error.”
Direct react-server-dom users should upgrade to React 19.0.6, 19.1.7, or 19.2.6 depending on the minor line they are on, per Netlify’s advisory.
WAF limitations
Cloudflare published its own changelog entry on May 7 acknowledging that some of the bugs in this batch sit beyond what a generic Web Application Firewall can reasonably block. Cloudflare’s post states that “several of the disclosed vulnerabilities are not possible to block in WAF” and that “We strongly recommend updating your applications so they are not purely reliant on WAF mitigations”. Cloudflare’s existing rules for prior React Server Component DoS issues — tied to CVE-2025-55184 and CVE-2026-23864 — already provide partial coverage of the new ones through generic pattern detection, the post says. Three additional High-severity advisories are still being studied to determine whether they can be safely mitigated without breaking real applications.
That overlaps with what Vercel itself said in its release notes about deploying no new rules. Operators running the framework outside Vercel’s edge will need to ship the patched binaries to be fully covered.
Hosting-platform adapter mitigations
Netlify, which runs Next.js through its OpenNext adapter, shipped an adapter update tagged v5.15.11 alongside the upstream patches. The Netlify changelog notes that the adapter “already varies cached responses on the x-nextjs-data header, preventing cache-poisoned redirect bypasses, and honors Vary on RSC-related headers to prevent RSC response cache poisoning,” giving Pages Router with i18n users a baseline of protection while they upgrade the framework itself. Netlify’s recommended sequence is “Upgrade next to 15.5.18 or 16.2.6 and redeploy,” and for Pages Router with i18n, also upgrade the OpenNext adapter to v5.15.11.
What We Don’t Know
The Next.js project has not assigned CVE identifiers to the individual Next.js advisories in this batch — only the upstream React Server Components bug has one (CVE-2026-23870). That makes vulnerability scanners and SBOM tooling reliant on GHSA references until CVE numbers are issued.
There is also no published evidence of in-the-wild exploitation for any of the thirteen advisories. None of the GHSA entries on GitHub list a known-exploited tag, and CISA has not added them to its Known Exploited Vulnerabilities catalog at publication time. The pre-existing CVE-2025-55184 DoS rule that Cloudflare references is unrelated to whether this newer batch is being abused.
The exact apportionment between Vercel’s stated count of 13 advisories and Netlify’s stated count of twelve vulnerabilities is the result of the May 7 follow-up advisory for the App Router segment-prefetch middleware-bypass fix being filed as a separate GHSA entry.
Analysis
The interesting feature of the release is not the individual bug severity — none of the ten visible Next.js advisories are rated Critical — but the structural pattern. Three of the ten cluster around middleware and proxy bypass through alternative request shapes (segment-prefetch routes, dynamic route parameter injection, the segment-prefetch follow-up), an authorization-boundary surface that has produced repeat findings in the App Router architecture. Two more concern cache poisoning at the RSC layer. The Pages Router i18n issue is patched at the OpenNext adapter level rather than within Next.js itself for users not yet on the upgraded framework, which suggests the fix landed in routing logic with no straightforward WAF-friendly pattern signature.
Vercel’s and Cloudflare’s parallel acknowledgments that the WAF cannot save unpatched deployments are unusual for a coordinated framework release. Most large-scale advisories ship with at least one signature-block recipe so customers behind a managed proxy can buy time before deploying. Here, the advice from both Vercel and Cloudflare points to the same conclusion: patch and redeploy.