# Next.js May 2026 security release

DevFeed: [Next.js May 2026 security release](<https://devfeed.tech/articles/next-js-may-2026-security-release-1027.md>)

Original publisher: [Read original article](<https://vercel.com/changelog/next-js-may-2026-security-release>)

Author: Jimmy Lai

Published: 2026-05-07T13:00:00Z

Content type: news

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [Next.js](<https://devfeed.tech/topics/next-js.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [React](<https://devfeed.tech/topics/react.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Caching](<https://devfeed.tech/topics/caching.md>), [WebSocket](<https://devfeed.tech/topics/websocket.md>)

Tags: [authorization](<https://devfeed.tech/tags/authorization.md>), [caching](<https://devfeed.tech/tags/caching.md>), [next-js](<https://devfeed.tech/tags/next-js.md>), [react](<https://devfeed.tech/tags/react.md>), [release](<https://devfeed.tech/tags/release.md>), [router](<https://devfeed.tech/tags/router.md>), [security](<https://devfeed.tech/tags/security.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>), [upgrades](<https://devfeed.tech/tags/upgrades.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Vercel announces a coordinated Next.js security release addressing 13 advisories involving denial of service, middleware and proxy authorization bypasses, server-side request forgery, cache poisoning, and cross-site scripting. The release includes an upstream React Server Components vulnerability tracked as CVE-2026-23870. Affected users are advised to upgrade to patched React and Next.js versions immediately.

## Source excerpt

Summary We have shipped a coordinated security release for Next.js addressing 13 advisories across denial of service, middleware and proxy bypass, server-side request forgery, cache poisoning, and cross-site scripting. One advisory addresses an upstream React Server Components vulnerability tracked as CVE-2026-23870. Recommended actions Patched versions are available for both React and Next.js, and all affected users should upgrade immediately. Impact The release addresses the following advisories: Middleware and proxy bypass Affects applications that rely on middleware.js or proxy.js for authorization. High: Auth bypass via App Router segment-prefetch URL High: App Router segment-prefetch bypass, incomplete fix follow-up High: Pages Router i18n default-locale path bypasses proxy authorization High: Bypass via dynamic route parameter injection Low: Middleware redirects can be cache-poisoned Denial of service Affects applications using Server Functions, Partial Prerendering with Cache Components, or the Image Optimization API. High: DoS in React Server Components (tracked upstream as CVE-2026-23870) High: DoS via connection exhaustion in applications using Cache Components Moderate: DoS via the Image Optimization API Server-side request forgery Affects applications that handle WebSocket upgrade requests. High: SSRF in applications using WebSocket upgrades Cache poisoning Affects applications with caching layers in front of React Server Component responses. Moderate: Cache poisoning in React Server Component responses Low: Cache poisoning via collisions in RSC cache-busting Cross-site scripting Affects applications using CSP nonces in App Router, or beforeInteractive scripts that consume untrusted input. Moderate: XSS in App Router applications using CSP nonces Moderate: XSS in beforeInteractive scripts with untrusted input Resolution These vulnerabilities are addressed by the patched releases of React and Next.js. Patching is the only complete mitigation, and all aff