emresandikci/nextjs-cve-2026-23870-checkerChecker and fixer for all 13 vulnerabilities in the Next.js May 2026 security release (CVE-2026-23870)
CLI checker and fixer for all 13 vulnerabilities in the Next.js May 2026 Security Release, including CVE-2026-23870 (DoS in React Server Components).
# Interactive mode (recommended)
npx @emstack/nextjs-cve-2026-23870-checker
# Check a project
npx @emstack/nextjs-cve-2026-23870-checker ~/my-app
# Fix
npx @emstack/nextjs-cve-2026-23870-checker ~/my-app --fix
| ID | Severity | Description |
|---|
| GHSA-8h8q-6873-q5fj | High | CVE-2026-23870 — DoS in React Server Components |
| GHSA-267c-6grr-h53f | High | Segment-prefetch URL authorization bypass in App Router |
| GHSA-26hh-7cqf-hhc6 | High | Incomplete fix follow-up for segment-prefetch bypass |
| GHSA-36qx-fr4f-26g5 | High | i18n default-locale path circumvents proxy authorization |
| GHSA-492v-c6pp-mqqv | High | Dynamic route parameter injection enables bypass |
| GHSA-mg66-mrh9-m8jx | High | Connection exhaustion affecting Cache Components |
| GHSA-c4j6-fc7j-m34r | High | SSRF via WebSocket upgrade request |
| GHSA-h64f-5h5j-jqjh | Moderate | Image Optimization API exploitation (DoS) |
| GHSA-wfc6-r584-vfw7 | Moderate | RSC response poisoning (cache) |
| GHSA-ffhc-5mcf-pf4q | Moderate | CSP nonce leakage in App Router |
| GHSA-gx5p-jg67-6x7h | Moderate | XSS via untrusted input in beforeInteractive scripts |
| GHSA-3g8h-86w9-wvmq | Low | Cache poisoning via middleware redirects |
| GHSA-vfv6-92ff-j949 | Low | Cache-busting collision vulnerability |
| Package | Vulnerable | Patched |
|---|---|---|
next 13.x, 14.x | All versions | Upgrade to 15.5.18 or 16.2.6 |
next 15.x | ≤ 15.5.17 | 15.5.18 |
next 16.x | ≤ 16.2.5 | 16.2.6 |
react-server-dom-* 19.0.x | ≤ 19.0.5 | 19.0.6 |
react-server-dom-* 19.1.x | ≤ 19.1.6 | 19.1.7 |
react-server-dom-* 19.2.x | ≤ 19.2.5 | 19.2.6 |
Checked react-server-dom-* packages: webpack, turbopack, bun, esm, deno.
Note: Patching is the only complete mitigation. WAF-level protection is unavailable for these vulnerabilities.
Launched by default when no arguments are given. Walks a root directory to discover Next.js projects, lets you pick which ones to scan, and optionally applies fixes.
npx @emstack/nextjs-cve-2026-23870-checker
npx @emstack/nextjs-cve-2026-23870-checker -i
npx @emstack/nextjs-cve-2026-23870-checker /path/to/your/nextjs-app
Exits with code 1 if vulnerabilities are found — CI-safe.
npx @emstack/nextjs-cve-2026-23870-checker ~/app1 ~/app2 ~/app3
Prints a per-project report and a summary line at the end.
npx @emstack/nextjs-cve-2026-23870-checker ~/my-app --dry-run
Updates package.json and runs the appropriate install command (bun, pnpm, yarn, or npm — auto-detected from lockfile).
npx @emstack/nextjs-cve-2026-23870-checker ~/my-app --fix
# Fix multiple projects at once
npx @emstack/nextjs-cve-2026-23870-checker ~/app1 ~/app2 --fix
npx @emstack/nextjs-cve-2026-23870-checker ~/my-app --json
Usage:
npx @emstack/nextjs-cve-2026-23870-checker [path...] [options]
Arguments:
path Project path(s) to scan (default: .)
Options:
-i, --interactive Interactive mode (default when no args given)
--fix Update package.json and run install
--dry-run Show what would change without writing files
--json Output results as JSON
--help, -h Show this help
bun install
bun run dev /path/to/your/nextjs-app
bun run build # produces dist/cli.js
Next.js May 2026 Security Release — 13 advisories
Scanning: /my-app
✗ Found 2 vulnerable package(s):
next
Installed: ^15.3.0 → Fix: 15.5.18
Advisories (13):
[High] [CVE-2026-23870] GHSA-8h8q-6873-q5fj — DoS in React Server Components
[High] GHSA-267c-6grr-h53f — Segment-prefetch URL authorization bypass in App Router
...
react-server-dom-webpack
Installed: ^19.1.5 → Fix: 19.1.7
Advisories (2):
[High] [CVE-2026-23870] GHSA-8h8q-6873-q5fj — DoS in React Server Components
[Moderate] GHSA-wfc6-r584-vfw7 — RSC response poisoning (cache)
Patching is the only complete mitigation. WAF-level protection unavailable.
Source: https://vercel.com/changelog/next-js-may-2026-security-release
Run with --fix to update package.json and install patched versions.
MIT