telexed ~ c / 149f374c-8ffradar:90 · infra_saasLIVE
← back
NO.
#149f374c
Topic
INFRA & SAAS
Source
vercel_blog
Published
2026-05-07 13:00:00
Importance
★ 9/10 — radar 90
`Next.js` security release patches 13 flaws; upgrade to `15.5.18` or `16.2.6`
FIG-1491:1

`Next.js` security release patches 13 flaws; upgrade to `15.5.18` or `16.2.6`

This fixes 13 issues across auth bypass, DoS, SSRF, cache poisoning, and XSS, with no reliable WAF fallback. If you run middleware.js, Server Functions, Image Optimization, or RSC caching, this is an immediate patch cycle.

[ KEY POINTS ]
  1. Authorization paths are exposed in multiple ways: middleware.js/proxy.js apps are affected by segment-prefetch, i18n default-locale, and dynamic route injection bypasses.
  2. Runtime risk is broad, not edge-case: DoS hits React Server Components, Cache Components, and the Image Optimization API, so default framework features are in scope.
  3. WebSocket upgrade handling has an SSRF advisory. Any app bridging internal services through upgrade requests should treat this as perimeter-breaking.
  4. Caching setups need scrutiny twice: one advisory targets RSC response poisoning, another targets collisions in RSC cache-busting. CDN or reverse-proxy stacks are not neutral here.
  5. Fixed targets are explicit: upgrade Next.js 15.x to 15.5.18, 16.x to 16.2.6, and matching react-server-dom-* packages to 19.0.6 / 19.1.7 / 19.2.6.
Originalvercel.com/changelog/next-js-may-2026-security-releaseRead original →

// related