wid-sec-w-2026-1011
·
Published 2026-04-08
·
View on BSI CERT-Bund ↗
Vercel Next.js: Vulnerability allows Denial of Service
CVSS N/A
NONE
Risk Summary
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
CVEs (1)
Affected Vendors
Vercel
Affected Products (4)
Vercel
·
Next.js
<15.5.15
Vercel
·
Next.js
15.5.15
Vercel
·
Next.js
<16.2.3
Vercel
·
Next.js
16.2.3
Get alerted to advisories like this
OTWarden monitors CISA, BSI, Siemens, Rockwell and more — and emails you within 2 hours when your vendors are affected.
Start free trial Learn more