React Components and Next.js vulnerabilities

[don]

WAF and framework adapter mitigations for React and Next.js vulnerabilities

Next.js DOS vulnerability: Denial of Service with Server Components · Advisory · vercel/next.js · GitHub

React Server DOS vulnerabilities: Denial of Service Vulnerability in React Server Components · Advisory · facebook/react · GitHub

[Emily]

It’s an entire party: Release v16.2.6 · vercel/next.js · GitHub

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

[Emily]

A good writeup: Next.js WebSocket Upgrade SSRF (CVE-2026-44578), Response Guide | NewMaxx Bulletin