Tia N.List

Reported by 2 outlets

Next.js critical vulnerability cluster — middleware auth bypasses, DoS, and SSRF across versions 13.x–16.x

new0.0
Why this score
Breadth
1.00 / 2.0 · 2 sources
Authority
1.20 / 2.0 · best outlet weight
Severity
3.50 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.00 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
cyberpress.orggbhackers.com CVE-2026-23870CVE-2026-44573CVE-2026-44574CVE-2026-44575CVE-2026-44578CVE-2026-44579 first seen 159d ago

Timeline

  1. original reporting

    Next.js critical vulnerability cluster — middleware auth bypasses, DoS, and SSRF across versions 13.x–16.x

    cyberpress.org · 159d ago · May 8th, 2026

    Vercel has released urgent patches (versions 15.5.16 and 16.2.5) addressing a cluster of high-severity vulnerabilities in Next.js. CVE-2026-44575 allows unauthenticated access to protected content via crafted .rsc URLs that bypass middleware rules. CVE-2026-44574 enables attackers to inject query parameters that hide request paths from middleware while still rendering protected backend data. CVE-2026-44573 exposes legacy Pages Router i18n deployments to unauthorized Server-Side Rendering JSON retrieval. CVE-2026-23870 causes CPU-exhausting DoS via crafted App Router Server Function payloads. CVE-2026-44579 triggers request-body deadlocks in Cache Components, exhausting file descriptors. CVE-2026-44578 is a critical SSRF in self-hosted Node.js deployments allowing unauthenticated WebSocket upgrade manipulation to proxy traffic to arbitrary destinations — Vercel-managed deployments are not affected.

  2. update from gbhackers.com

    React Server Components Vulnerability Lets Attackers Freeze Next.js Servers With a Single Request

    gbhackers.com · 4d ago · October 9th, 2026

    A security vulnerability has been identified in React Server Components deployments using specific vulnerable releases of React 19. An attacker can exploit this flaw to create a denial-of-service condition through specially crafted HTTP POST requests, as detailed in CVE-2026-23870. React Server Components Vulnerability Tracked as CVE-2026-23870 and GHSA-rv78-f8rc-xrxh, this high-severity vulnerability affects React Server Components […] The post React Server Components Vulnerability Lets Attackers Freeze Next.js Servers With a Single Request appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

Source on GitHub