highnextGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
Affected versions
>= 13.0.0, < 15.0.8, fixed in 15.0.8>= 15.1.1-canary.0, < 15.1.12, fixed in 15.1.12>= 15.2.0-canary.0, < 15.2.9, fixed in 15.2.9>= 15.3.0-canary.0, < 15.3.9, fixed in 15.3.9>= 15.4.0-canary.0, < 15.4.11, fixed in 15.4.11>= 15.5.1-canary.0, < 15.5.10, fixed in 15.5.10>= 15.6.0-canary.0, < 15.6.0-canary.61, fixed in 15.6.0-canary.61>= 16.0.0-beta.0, < 16.0.11, fixed in 16.0.11>= 16.1.0-canary.0, < 16.1.5, fixed in 16.1.5
Published 2026-01-28. Last checked 2026-11-01. Read the source advisory