Next.js Security Crisis: What Do 13 New CVEs Tell Us?

The May 2026 security advisories for Next.js are more than an ordinary "update your packages" note. The vulnerabilities published on Vercel's GitHub advisory pages within the same week touch some of the framework's most critical layers: React Server Components, the App Router, the Pages Router, middleware/proxy, the WebSocket upgrade flow, cache keying and beforeInteractive script handling.

It is easy to look at this as "Next.js got hacked again." But the more useful question is this: what do these vulnerabilities show us about where modern full-stack frontend frameworks become fragile? Because we are not talking about a single faulty if condition here, but about the difficulty of managing the security boundaries of a multi-layered architecture.

The Common Story Behind 13 CVEs

The most striking thing about the new advisories is their variety. Some of the vulnerabilities stem directly from Next.js's routing and proxy behavior. Some are tied to deeper React infrastructure such as React Server Components and the React Flight Protocol. Others target interpretation differences that show up in deployment environments such as CDNs, reverse proxies and shared caches.

Among the high-severity items in Vercel's advisory list are a middleware/proxy bypass in setups using the Pages Router + i18n, bypass scenarios involving segment-prefetch routes on the App Router side, dynamic route parameter injection, connection exhaustion in apps using Cache Components, and SSRF via WebSocket upgrade. On top of these come medium- and low-severity issues that can still be annoying in practice, such as RSC cache poisoning, _rsc cache-busting collisions, Image Optimization API DoS and XSS in beforeInteractive scripts.

It matters that six of the vulnerabilities are rated high severity. That level means not just a theoretical bug, but a risk that can lead to concrete outcomes such as data leakage, authorization bypass or service outages under certain configurations.

Middleware Bypass: Pushing Security to the Edge

One of the most instructive examples is the middleware/proxy bypass in apps that use the Pages Router and have an i18n configuration. In this vulnerability, tracked as CVE-2026-44573, the problem is that /_next/data//.json requests without a locale can reach the protected page's SSR JSON data without passing through the expected middleware check.

This reminds us of an old lesson: leaving authorization solely to path matching or to the middleware layer is risky. Middleware can be a perfect place to route users to the right page; but if there is no authorization check on the actual data-producing path as well, the framework's alternative data routes can turn into an unexpected back door.

The same logic shows up in the dynamic route parameter injection vulnerability. An attacker being able to change the dynamic value the page sees through specially crafted query parameters can cause the wrong content to be rendered even while the visible path stays the same. Vulnerabilities like this show how weak the assumption "if the URL looks like this, it's safe" has become.

React Flight and the DoS Risk

One of the most serious items on the React Server Components side is CVE-2026-23870. This vulnerability concerns specially crafted HTTP requests causing excessive CPU consumption during React Flight Protocol deserialization. The GitHub advisory states that payloads sent to App Router Server Function endpoints can produce a denial of service in unpatched environments.

The issue here is not just "a bad request wore out the server." React Flight uses a custom serialization/deserialization model to transfer the server component tree to the client. This model is powerful for performance and developer experience, but it also creates a new protocol surface that attackers can target. When defenses in the deserialization layer, such as validation, depth limits, resource usage controls and blocking unexpected reference structures, are missing, a small request can turn into a large CPU cost.

We saw a similar picture when the React team published RCE, DoS and source code exposure vulnerabilities on the RSC side at the end of 2025. This new wave suggests that RSC's security model is still maturing.

SSRF via WebSocket Upgrade

CVE-2026-44578, meanwhile, is especially important for self-hosted Next.js apps. The vulnerability concerns specially crafted WebSocket upgrade requests being able to force the server to proxy to arbitrary internal or external targets in apps that use the built-in Node.js server. Vercel-hosted deployments are stated to be unaffected; but for teams exposing their own origin server directly to the internet, the SSRF risk is serious.

The danger of SSRF is that the attacker can gain indirect access not only to your application but also to the internal network your application can reach. Cloud metadata endpoints, internal admin services or APIs considered safe just because they live on a private network can become targets in this scenario.

On the fix side, Next.js applies the security checks that already exist for normal HTTP requests to the WebSocket upgrade handling flow as well. That is a good lesson too: if two channels in a framework that look like "the same routing behavior" do not pass through the same security checks, divergence begins.

Cache Poisoning and the _rsc Issue

The RSC cache poisoning vulnerabilities may seem quieter, but they are unpleasant for high-traffic sites. CVE-2026-44576 describes how, under conditions where shared caches do not separate response variants correctly, an RSC payload can settle into the cache as a poisoned variant under the normal URL. As a result, subsequent visitors can receive the component payload instead of the expected HTML.

Another advisory says that collisions in the _rsc cache-busting value can bring the wrong response variants together in the same cache entry. Although this vulnerability is listed as low severity, in systems where CDN behavior and Vary headers are mismanaged it can lead to breakages that are hard to debug.

The practical takeaway from this section is clear: in apps that use RSC, thinking about CDN and reverse proxy configuration with the simplicity of "I'm caching static HTML" is no longer enough. RSC headers, cache key separation and response variants must be designed deliberately.

beforeInteractive XSS: Small API, Big Impact

CVE-2026-44580 brings up an XSS risk in apps that pass untrusted data to beforeInteractive scripts. In affected versions, because serialized script content is not escaped safely enough before being embedded in the page, attacker-controlled content can break out of the inline script boundary.

This vulnerability is listed as medium severity, because the application usually already has to carry untrusted data into this area. Still, the message is clear: script strategies may look like a performance optimization, but when the data boundary is drawn wrong, they can turn directly into a code execution risk in the browser.

What Should Developers Do?

The shortest answer: upgrade Next.js to the patched lines. In the May 2026 advisories, the patch versions for many vulnerabilities are given as 15.5.16 and 16.2.5. In projects that use React Server Components, also make sure React and the react-server-dom-* packages are up to date.

But upgrading alone is not enough. Move authorization checks beyond middleware as well. Have real authorization checks in the server-side data path, route handlers, server actions and API layers. If you are self-hosting, don't expose your origin server directly to the internet; if you don't need WebSocket upgrades, shut them off at the proxy level. Test RSC-related Vary and cache key behavior on the CDN side. Don't put raw user-supplied data into beforeInteractive.

Does Moving Away from Next.js Make Sense?

It is understandable that some developers are turning to TanStack, Astro or tools with a simpler server/client separation. Next.js, especially with the App Router and RSC, is no longer just a "routing framework for React"; it is a large platform with a custom protocol, a server runtime, a cache system, streaming, partial rendering and deployment assumptions.

That power also means a larger attack surface. But the picture has to be read fairly: widely used projects get scrutinized more, produce more CVEs and enter faster patch cycles. The problem is not that CVEs get published; it is whether teams understand this complexity, whether the framework documents its security assumptions, and whether production environments actually conform to those assumptions.

My conclusion is this: Next.js is still a powerful tool, but it is no longer a "install, deploy, forget" tool. Teams using RSC, middleware, cache and self-hosting need to explicitly own the security model. Choosing a simpler stack can sometimes be the right security decision. But if you are going to keep using Next.js, dependency updates should be seen not as a chore but as part of the architecture.

Sources: Vercel/Next.js GitHub security advisories, React security blog announcements, and Cloudflare's and Netlify's May 2026 React/Next.js security notes.