Next Vulnerable to Denial of Service with Server Components

Affected releases · next

16.x16.0.0 – 16.0.8Fixed in 16.0.9
15.x15.0.0 – 15.5.7Fixed in 15.5.8
14.x14.0.0 – 14.2.33Fixed in 14.2.34
13.x13.3.0 – 13.5.11No fix on this line yet

On 16.x, the newest line:

npm install next@16.0.9

16.x

Affected
16.0.0 – 16.0.8
9 releases
Fixed
16.0.9 – 16.4.2
36 releases, latest

15.x

Affected
15.0.0 – 15.0.5
6 releases
Fixed
15.0.6 – 15.1.0
4 releases
Affected
15.1.1 – 15.1.9
9 releases
Fixed
15.1.10 – 15.1.12
3 releases
Affected
15.2.0 – 15.2.6
7 releases
Fixed
15.2.7 – 15.2.9
3 releases
Affected
15.3.0 – 15.3.6
7 releases
Fixed
15.3.7 – 15.3.9
3 releases
Affected
15.4.0 – 15.4.8
9 releases
Fixed
15.4.9 – 15.5.0
4 releases
Affected
15.5.1 – 15.5.7
7 releases
Fixed
15.5.8 – 15.5.28
20 releases

14.x

Affected
14.0.0 – 14.2.33
44 releases
Fixed
14.2.34 – 14.2.35
2 releases

13.x

Not affected
13.0.0 – 13.2.4
20 releases
Affected
13.3.0 – 13.5.11
36 releases

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184.

A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.