GHSA-8h8q-6873-q5fj

Next.js Vulnerable to Denial of Service with Server Components

Published: May 11, 2026Modified: May 13, 2026

Severity

HIGH

CVSS Scores

7.5/ 10.0

CVSS_V3

High

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.

Affected Packages

nextnpm

Version Ranges:

Version Range: 13.0.0 - 15.5.16

nextnpm

Version Ranges:

Version Range: 16.0.0 - 16.2.5

References

https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxhWEB https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fjWEB

GHSA-8h8q-6873-q5fj - Next.js Vulnerable to Denial of Service with Server Components | OSV Watch