Packages / next / Security

HighVulnerabilityGHSA-h25m-26qc-wcjfPublished 28 Jan 2026

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

Affected releases · next

  • 16.x16.0.0 – 16.1.4Fixed in 16.1.5
  • 15.x15.0.0 – 15.5.9Fixed in 15.5.10
  • 14.x14.0.0 – 14.2.35No fix on this line yet
  • 13.x13.0.0 – 13.5.11No fix on this line yet

On 16.x, the newest line:

npm install next@16.1.5
16.x

  1. Affected

    16.0.0 – 16.0.10

    11 releases

  2. Fixed

    16.0.11

    1 release

  3. Affected

    16.1.0 – 16.1.4

    5 releases

  4. Fixed

    16.1.5 – 16.4.2

    28 releases, latest

15.x

  1. Affected

    15.0.0 – 15.0.7

    8 releases

  2. Fixed

    15.0.8 – 15.1.0

    2 releases

  3. Affected

    15.1.1 – 15.1.11

    11 releases

  4. Fixed

    15.1.12

    1 release

  5. Affected

    15.2.0 – 15.2.8

    9 releases

  6. Fixed

    15.2.9

    1 release

  7. Affected

    15.3.0 – 15.3.8

    9 releases

  8. Fixed

    15.3.9

    1 release

  9. Affected

    15.4.0 – 15.4.10

    11 releases

  10. Fixed

    15.4.11 – 15.5.0

    2 releases

  11. Affected

    15.5.1 – 15.5.9

    9 releases

  12. Fixed

    15.5.10 – 15.5.28

    18 releases

14.x

  1. Affected

    14.0.0 – 14.2.35

    46 releases

13.x

  1. Affected

    13.0.0 – 13.5.11

    56 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.