Next.js May 2026 security release

T1Covered by 1 source · first reported by Vercel (blog + changelog) at 07 May, 13:00 UTC

Summary CVE-2026-23870 We have shipped a coordinated security release for Next.js addressing 13 advisories across denial of service, middleware and proxy bypass, server-side request forgery, cache poisoning, and cross-site scripting. One advisory addresses an upstream React Server Components…