# Summary of CVE-2026-23869

DevFeed: [Summary of CVE-2026-23869](<https://devfeed.tech/articles/summary-of-cve-2026-23869-1104.md>)

Original publisher: [Read original article](<https://vercel.com/changelog/summary-of-cve-2026-23869>)

Author: Vercel Security

Published: 2026-04-08T07:00:00Z

Content type: news

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>)

Tags: [cpu](<https://devfeed.tech/tags/cpu.md>), [http](<https://devfeed.tech/tags/http.md>), [next-js](<https://devfeed.tech/tags/next-js.md>), [react](<https://devfeed.tech/tags/react.md>), [releases](<https://devfeed.tech/tags/releases.md>), [vercel](<https://devfeed.tech/tags/vercel.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

Vercel reports CVE-2026-23869, a high-severity React Server Components denial-of-service vulnerability affecting App Router packages in Next.js 13.x through 16.x. It recommends upgrading to patched releases; Vercel WAF mitigations are not a substitute for upgrading.

## Source excerpt

Summary A high-severity vulnerability (CVSS 7.5) in React Server Components can lead to Denial of Service. We created new rules to address these vulnerabilities and deployed them to the Vercel WAF to automatically protect all projects hosted on Vercel at no cost. However, do not rely on the WAF for full protection. Immediate upgrades to a patched version are required. Impact A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments. These vulnerabilities are present in Next.js 13.x, 14.x, 15.x, 16.x and affected packages using the App Router. The issue is tracked upstream as CVE-2026-23869 Resolution After creating mitigations to address this vulnerability, we deployed them across our globally-distributed platform to protect our customers. We still recommend upgrading to the latest patched version. Updated releases of React and affected downstream frameworks include fixes to prevent this issue. All users should upgrade to a patched version as soon as possible. Fixed In = 15.0.0 to be fixed in 15.5.15 = 16.0.0 to be fixed in 16.2.3 Read more