Summary
Vercel published a coordinated May 2026 security release for Next.js, covering 13 advisories across denial of service, middleware and proxy bypass, SSRF, cache poisoning, and XSS. The update also points teams to patched React and Next.js versions and recommends immediate upgrades.
What changed
Vercel shipped a coordinated Next.js security release and published patched-version guidance for 13 advisories, including an upstream React Server Components issue tracked as CVE-2026-23870.
Why it matters
This is the kind of security event that changes deployment posture, not just framework version numbers. Teams building AI-heavy and agent-driven apps on Next.js now have another reminder that app-layer security, middleware controls, and dependency freshness are becoming platform buying criteria.
Evidence excerpt
Vercel says it shipped a coordinated security release for Next.js addressing 13 advisories and recommends all users upgrade to patched React and Next.js versions.