Denial of Service Vulnerability in Next.js due to HTTP Request Deserialization
Summary
GHSA-h25m-26qc-wcjf: Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components. Affects next across 9 version ranges.
>= 13.0.0, < 15.0.8
>= 15.1.1-canary.0, < 15.1.12
>= 15.2.0-canary.0, < 15.2.9
>= 15.3.0-canary.0, < 15.3.9
>= 15.4.0-canary.0, < 15.4.11
>= 15.5.1-canary.0, < 15.5.10
>= 15.6.0-canary.0, < 15.6.0-canary.61
>= 16.0.0-beta.0, < 16.0.11
>= 16.1.0-canary.0, < 16.1.5
Fixed in 9 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular React framework that enables developers to build server-rendered applications with ease. It provides features like automatic code splitting, server-side rendering, and static site generation. However, certain versions of Next.js are vulnerable to a denial of service (DoS) attack due to improper handling of HTTP request deserialization when using React Server Components.
Vulnerability Detail
A vulnerability exists in specific versions of React Server Components packages and frameworks that utilize them, including Next.js versions 13.x through 16.x with the App Router. This vulnerability allows an attacker to send a specially crafted HTTP request to any App Router Server Function endpoint. Upon deserialization, this request can lead to excessive CPU usage, out-of-memory exceptions, or server crashes, ultimately resulting in a denial of service in unpatched environments. The issue is tracked as CVE-2026-23864.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 13.0.0, < 15.0.815.0.8npm install next@15.0.8 -
>= 15.1.1-canary.0, < 15.1.1215.1.12npm install next@15.1.12 -
>= 15.2.0-canary.0, < 15.2.915.2.9npm install next@15.2.9 -
>= 15.3.0-canary.0, < 15.3.915.3.9npm install next@15.3.9 -
>= 15.4.0-canary.0, < 15.4.1115.4.11npm install next@15.4.11 -
>= 15.5.1-canary.0, < 15.5.1015.5.10npm install next@15.5.10
Show all 9 release lines
-
>= 15.6.0-canary.0, < 15.6.0-canary.6115.6.0-canary.61npm install next@15.6.0-canary.61 -
>= 16.0.0-beta.0, < 16.0.1116.0.11npm install next@16.0.11 -
>= 16.1.0-canary.0, < 16.1.516.1.5npm install next@16.1.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on your server to mitigate the impact of potential denial of service attacks. This can be done using middleware in your Next.js application to limit the number of requests from a single IP address.
Conclusion
In summary, the identified vulnerability in Next.js due to HTTP request deserialization poses a significant risk of denial of service. It is crucial for developers using affected versions to update to the patched versions promptly and consider implementing rate limiting as a temporary measure.
See every vulnerability recorded for next →
FAQ
Next.js versions 13.x, 14.x, 15.x, and 16.x using the App Router are affected.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The vulnerability can lead to denial of service, causing excessive CPU usage, out-of-memory exceptions, or server crashes.
Yes, implementing rate limiting on your server can help mitigate the risk of denial of service attacks until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for next.
