Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/next@15.5.15
purl pkg:npm/next@15.5.15
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-asd4-96ec-vqav Next.js has a Denial of Service with Server Components A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg). You can read more about this advisory our [this changelog](https://vercel.com/changelog/summary-of-cve-2026-23869). A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments. GHSA-q4gf-8mx6-v5v3

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-13T07:05:10.349293+00:00 GHSA Importer Fixing VCID-asd4-96ec-vqav https://github.com/advisories/GHSA-q4gf-8mx6-v5v3 38.3.0
2026-04-11T12:45:29.067529+00:00 GithubOSV Importer Fixing VCID-asd4-96ec-vqav https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-q4gf-8mx6-v5v3/GHSA-q4gf-8mx6-v5v3.json 38.3.0