CVE-2026-23870
- CVSS
- —
- EPSS
- 0.015 (73.7th percentile)
- CISA KEV
- Not listed
- Exploitation
- No report
- Public exploits
- None seen
- State
- Unknown
Coverage
Vercel (blog + changelog)
Next.js May 2026 security release
Summary CVE-2026-23870 We have shipped a coordinated security release for Next.js addressing 13 advisories across denial of service, middleware and proxy bypass, server-side request forgery, cache poisoning, and cross-site scripting. One advisory addresses an upstream React Server Components…
What we observed
No signals recorded