`Next.js` security release patches 13 flaws; upgrade to `15.5.18` or `16.2.6`
This fixes 13 issues across auth bypass, DoS, SSRF, cache poisoning, and XSS, with no reliable WAF fallback. If you run middleware.js, Server Functions, Image Optimization, or RSC caching, this is an immediate patch cycle.
- Authorization paths are exposed in multiple ways:
middleware.js/proxy.jsapps are affected by segment-prefetch, i18n default-locale, and dynamic route injection bypasses. - Runtime risk is broad, not edge-case: DoS hits React Server Components, Cache Components, and the Image Optimization API, so default framework features are in scope.
WebSocketupgrade handling has an SSRF advisory. Any app bridging internal services through upgrade requests should treat this as perimeter-breaking.- Caching setups need scrutiny twice: one advisory targets RSC response poisoning, another targets collisions in RSC cache-busting. CDN or reverse-proxy stacks are not neutral here.
- Fixed targets are explicit: upgrade
Next.js15.xto15.5.18,16.xto16.2.6, and matchingreact-server-dom-*packages to19.0.6/19.1.7/19.2.6.