Next.js May 2026 security release

Next.js and React released coordinated security patches addressing 13 vulnerabilities in denial of service, middleware bypass, SSRF, cache poisoning, and XSS.

• •13 security advisories covering DoS, middleware/proxy bypass, SSRF, cache poisoning, and XSS attacks
• •Addresses upstream React Server Components vulnerability CVE-2026-23870
• •Patched versions: Next.js 15.5.18/16.2.6, React 19.0.6/19.1.7/19.2.6
• •Affects Server Functions, Partial Prerendering, Image Optimization API, WebSockets, and CSP nonces
• •Immediate upgrade required; WAF-layer mitigation is unreliable

This summary was automatically generated by AI based on the original article and may not be fully accurate.