---
title: "Security | Netlify Changelog"
description: "Get the latest updates on Netlify products and features to meet your developer needs."
source: "https://www.netlify.com/changelog/tag/security/"
last_updated: "2026-08-05T00:20:47.000Z"
---
# Posts tagged "Security"

All Tags Agent-runners AI Ai-gateway Angular Astro AX Build CLI Database Design Devtools Domains E-commerce Extensions Forms Framework Functions Logs Next.js Nuxt.js Remix SDK Security Updates Workflow  [Subscribe to feed](https://www.netlify.com/changelog/tag/security/feed.xml)

-   [
    
    ## Security Update: Multiple vulnerabilities in Nuxt
    
    ](/changelog/2026-07-27-nuxt-security-vulnerabilities/)
    
    July 27, 2026
    
    -   [security](/changelog/tag/security/)
    -   [nuxt.js](/changelog/tag/nuxt-js/)
    
    The Nuxt team has disclosed [several security vulnerabilities](https://github.com/nuxt/nuxt/security/advisories) fixed in Nuxt 4.5.1 and 3.21.10, ranging from a high-severity server-side remote code execution (under specific conditions) to lower-severity and development-only issues. Here’s what Netlify customers need to know.
    
    ## Vulnerabilities
    
    -   [**GHSA-9473-5f9j-94wq**](https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq) (High): remote code execution via [server island](https://nuxt.com/docs/4.x/api/components/nuxt-island) props
    -   [**GHSA-48hr-524c-v5w3**](https://github.com/nuxt/nuxt/security/advisories/GHSA-48hr-524c-v5w3) (Medium): unauthorized component instantiation via server island props
    -   [**GHSA-hxvh-4h3w-prp9**](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9) (High): route rule authorization bypass when a route rule key contains an uppercase character
    -   [**GHSA-hxcr-hm88-mpq6**](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxcr-hm88-mpq6) and [**GHSA-9pgf-384g-p7mv**](https://github.com/nuxt/nuxt/security/advisories/GHSA-9pgf-384g-p7mv) (High): server component denial of service
    -   [**GHSA-wm8w-6qjm-cv43**](https://github.com/nuxt/nuxt/security/advisories/GHSA-wm8w-6qjm-cv43) (High): cross-user disclosure of cached payloads (Nuxt 4.x only, 4.4.0 and later)
    -   [**GHSA-7c4v-fwgw-9rf7**](https://github.com/nuxt/nuxt/security/advisories/GHSA-7c4v-fwgw-9rf7) (Low): dev server path disclosure
    -   [**GHSA-279x-mwfv-vcqv**](https://github.com/nuxt/nuxt/security/advisories/GHSA-279x-mwfv-vcqv) (Critical, development only): remote code execution in Nuxt DevTools, fixed in `@nuxt/devtools@3.3.1`
    
    ## Impact on Netlify
    
    ### Remote code execution (GHSA-9473-5f9j-94wq)
    
    This issue **only applies under uncommon conditions**: it requires Vue’s runtime compiler (`vue.runtimeCompiler: true`, which is off by default) and a server island that forwards untrusted input into a component. Few applications meet both conditions, so real-world exposure is limited. We’ve proactively reached out to the very small number of Netlify customers whose projects could potentially be affected.
    
    ### Route rule authorization bypass (GHSA-hxvh-4h3w-prp9)
    
    This is a framework-level issue that affects Nuxt apps **regardless of hosting provider**. It is not specific to Netlify. **You’re affected if you use `routeRules` with `appMiddleware` as an authorization gate and any rule key contains an uppercase character**, such as a rule derived from a page like `pages/Admin.vue` or written explicitly as `routeRules: { '/Admin': ... }`. Because routing is case-insensitive by default, the page was served while its route rule (and the middleware guarding it) was silently skipped. This is a regression in the earlier fix for [CVE-2026-53721](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47), so upgrading only to 4.4.7 or 3.21.7 does not protect you. Upgrade to Nuxt 4.5.1 or 3.21.10, then audit any uppercase route rule keys used for access control.
    
    ### Denial of service (GHSA-hxcr-hm88-mpq6, GHSA-9pgf-384g-p7mv)
    
    These are server-side denial-of-service (DoS) vulnerabilities. **On Netlify, these have minimal impact**: our autoscaling serverless architecture means that a malicious request resulting in a crashed or hung function does not affect other requests. However, active exploitation could increase your function costs.
    
    ### Cross-user payload disclosure (GHSA-wm8w-6qjm-cv43)
    
    If you use the `cache`, `swr`, or `isr` route rules on authenticated pages that render user-specific data, a cached payload could be served to the wrong user. **After upgrading, purge any upstream CDN cache (e.g. Akamai or Cloudflare) that may already be holding a leaked payload.** Upgrading alone won’t evict it.
    
    ### Development-only issues (GHSA-279x-mwfv-vcqv, GHSA-7c4v-fwgw-9rf7)
    
    The Nuxt DevTools remote code execution and the dev server path disclosure **only affect local development**, not deployed Netlify sites. Still, refresh your lockfile so it picks up `@nuxt/devtools@3.3.1`.
    
    ## What should I do?
    
    We strongly recommend upgrading as soon as possible to a patched release:
    
    -   `nuxt` 4.5.1 or later (for Nuxt 4)
    -   `nuxt` 3.21.10 or later (for Nuxt 3)
    
    Running `npx nuxt upgrade --dedupe` also refreshes your lockfile so it pulls in `@nuxt/devtools@3.3.1`, which fixes the critical development-only issue above.
    
    Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are [automatically deleted](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#automatic-deploy-deletion). Consider [deleting these deploys manually](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#manual-deploy-deletion-through-the-netlify-ui).
    
    ## Resources
    
    -   [Nuxt security post](https://nuxt.com/blog/v4-5-security)
    -   [Nuxt security advisories](https://github.com/nuxt/nuxt/security/advisories)
    
    [Permalink to Security Update: Multiple vulnerabilities in Nuxt Permalink](/changelog/2026-07-27-nuxt-security-vulnerabilities/)
    
-   [
    
    ## Security Update: Multiple vulnerabilities in React Router
    
    ](/changelog/2026-07-23-react-router-security-vulnerabilities/)
    
    July 23, 2026
    
    -   [security](/changelog/tag/security/)
    -   [framework](/changelog/tag/framework/)
    
    The React Router team has disclosed five security vulnerabilities affecting React Router. These issues are patched in React Router 7.18.0 (one issue was patched earlier, in 7.13.0). Here’s what Netlify customers need to know.
    
    ## Vulnerabilities
    
    Vulnerability
    
    CVE
    
    Severity
    
    Affected versions
    
    Patched in
    
    Open redirect leading to XSS
    
    CVE-2026-53668
    
    Medium
    
    ≥6.30.2 ≤6.30.4, ≥7.9.6 <7.13.0
    
    7.13.0
    
    Unauthenticated Denial of Service in React Router \_\_manifest endpoint
    
    CVE-2026-55685
    
    High
    
    ≥7.0.0 <7.18.0
    
    7.18.0
    
    RSCErrorHandler Missing Protocol Validation (XSS)
    
    CVE-2026-53667
    
    Medium
    
    ≥7.11.0 <7.18.0
    
    7.18.0
    
    Arbitrary client-side constructor injection via React Router SSR Hydration
    
    CVE-2026-53666
    
    Medium
    
    ≥6.4.0 <7.18.0
    
    7.18.0
    
    Unexpected external redirect via untrusted paths
    
    CVE-2026-53669
    
    Medium
    
    ≥6.0.0 <7.18
    
    7.18.0
    
    ## Impact on Netlify
    
    ### Open redirect leading to XSS
    
    Attacker-controlled redirect targets combined with path concatenation and `useNavigate` can escape the intended app path, resulting in open redirects or XSS via `javascript:` URLs. This affects Declarative, Data, and Framework mode apps that pass user-controlled values into navigation APIs.
    
    **Regardless of hosting provider, all apps passing untrusted data into navigation APIs may be vulnerable.**
    
    ### Unauthenticated Denial of Service in React Router \_\_manifest endpoint
    
    Deep, attacker-controlled paths can trigger expensive synchronous route matching, blocking the Node.js event loop with a single unauthenticated request to manifest endpoints (`__manifest`, and `*.manifest` in unstable RSC mode). This affects Framework mode with SSR only, including unstable RSC framework mode.
    
    This is a server-side denial-of-service (DoS) vulnerability. **On Netlify, this has minimal impact**: our autoscaling serverless architecture means that a malicious request resulting in a crashed or hung function does not affect other requests. However, active exploitation could increase your function costs.
    
    ### RSCErrorHandler Missing Protocol Validation (XSS)
    
    One RSC redirect handling path was missing protocol validation. Apps that redirect to attacker-controlled values may execute dangerous schemes such as `javascript:`. This only affects apps using unstable RSC Data or RSC Framework mode.
    
    **Regardless of hosting provider, all RSC apps redirecting to untrusted values may be vulnerable.** Note that this affects an experimental feature only.
    
    ### Arbitrary client-side constructor injection via React Router SSR Hydration
    
    Serialized server errors can carry a subtype that’s resolved against `window` during hydration. Apps that set user-controlled input into `error.name` could have this instantiate browser constructors such as `EventSource`, `WebSocket`, `Worker`, or `Image`. This affects Data and Framework mode SSR hydration.
    
    **Regardless of hosting provider, apps setting user-controlled values into `error.name` may be vulnerable.** This requires an unusual application code path, so real-world impact is expected to be low.
    
    ### Unexpected external redirect via untrusted paths
    
    Backslash-based URL forms such as `\\evil.com`, `/\evil.com`, or `\/evil.com` can be interpreted by browsers as cross-origin navigations, bypassing protections that only account for `//`. This affects `<Link>`, `useNavigate`, and redirects across Declarative, Data, Framework, and RSC modes.
    
    **Regardless of hosting provider, all apps passing untrusted destinations to `<Link>`, `useNavigate`, or redirects may be vulnerable.**
    
    ## What should I do?
    
    We strongly recommend upgrading as soon as possible to patched releases:
    
    -   `react-router` 7.18.0 or later (all five issues)
    -   `react-router` 7.13.0 or later addresses the open redirect leading to XSS issue only — upgrade to 7.18.0 for full coverage
    
    Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are [automatically deleted](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#automatic-deploy-deletion). Consider [deleting these deploys manually](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#manual-deploy-deletion-through-the-netlify-ui).
    
    ## Resources
    
    -   [Open redirect leading to XSS (CVE-2026-53668)](https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2)
    -   [Unauthenticated Denial of Service in React Router \_\_manifest endpoint (CVE-2026-55685)](https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5)
    -   [RSCErrorHandler Missing Protocol Validation (XSS) (CVE-2026-53667)](https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh)
    -   [Arbitrary client-side constructor injection via React Router SSR Hydration (CVE-2026-53666)](https://github.com/remix-run/react-router/security/advisories/GHSA-337j-9hxr-rhxg)
    -   [Unexpected external redirect via untrusted paths (CVE-2026-53669)](https://github.com/remix-run/react-router/security/advisories/GHSA-wrjc-x8rr-h8h6)
    
    [Permalink to Security Update: Multiple vulnerabilities in React Router Permalink](/changelog/2026-07-23-react-router-security-vulnerabilities/)
    
-   [
    
    ## Security Update: Multiple vulnerabilities in Next.js
    
    ](/changelog/2026-07-21-nextjs-security-vulnerabilities/)
    
    July 21, 2026
    
    -   [security](/changelog/tag/security/)
    -   [next.js](/changelog/tag/next-js/)
    
    The Next.js team has disclosed [nine security vulnerabilities](https://github.com/vercel/next.js/security), all patched in **15.5.21** and **16.2.11**. The issues span server-side request forgery (SSRF), a middleware authorization bypass, denial of service (DoS), and cache/identifier disclosure. Here’s what Netlify customers need to know.
    
    ## Summary
    
    If you run Next.js on Netlify, **upgrade `next` to 15.5.21 or 16.2.11** and redeploy. Netlify-hosted sites are **not affected** by three of these (Server Action `Host` forwarding, the Image Optimizer DoS, and the Edge-runtime OOM). The rest affect only apps using a specific pattern or configuration, and are resolved by upgrading — see [Impact on Netlify](#impact-on-netlify) for the per-issue verdict.
    
    ## Vulnerabilities
    
    All issues are patched in **15.5.21** and **16.2.11**. Earlier minors of 15.x and 16.x will not be patched; affected projects must upgrade to a patched minor. Follow the GHSA links for full details.
    
    Vulnerability
    
    Severity
    
    Affected versions
    
    [CVE-2026-64645](https://www.cve.org/CVERecord?id=CVE-2026-64645) / [GHSA-p9j2-gv94-2wf4](https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4) — Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
    
    High
    
    ≥12.0.0 <15.5.21, ≥16.0.0 <16.2.11
    
    [CVE-2026-64649](https://www.cve.org/CVERecord?id=CVE-2026-64649) / [GHSA-89xv-2m56-2m9x](https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x) — Server-Side Request Forgery in Server Actions on custom servers
    
    High
    
    ≥14.1.1 <15.5.21, ≥16.0.0 <16.2.11
    
    [CVE-2026-64642](https://www.cve.org/CVERecord?id=CVE-2026-64642) / [GHSA-6gpp-xcg3-4w24](https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24) — Middleware / Proxy bypass in App Router applications using Turbopack and single locale
    
    High
    
    ≥16.0.0 <16.2.11
    
    [CVE-2026-64641](https://www.cve.org/CVERecord?id=CVE-2026-64641) / [GHSA-m99w-x7hq-7vfj](https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj) — Denial of Service in App Router using Server Actions
    
    High
    
    ≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11
    
    [CVE-2026-64644](https://www.cve.org/CVERecord?id=CVE-2026-64644) / [GHSA-q8wf-6r8g-63ch](https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch) — Denial of Service in the Image Optimization API using SVGs
    
    Medium
    
    ≥15.5.0 <15.5.21, ≥16.0.0 <16.2.11
    
    [CVE-2026-64646](https://www.cve.org/CVERecord?id=CVE-2026-64646) / [GHSA-4c39-4ccg-62r3](https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3) — Unbounded Server Action payload in Edge runtime
    
    Medium
    
    ≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11
    
    [CVE-2026-64648](https://www.cve.org/CVERecord?id=CVE-2026-64648) / [GHSA-68g3-v927-f742](https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742) — Cache confusion of response bodies for requests with bodies
    
    Medium
    
    ≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11
    
    [CVE-2026-64647](https://www.cve.org/CVERecord?id=CVE-2026-64647) / [GHSA-4633-3j49-mh5q](https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q) — Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
    
    Medium
    
    ≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11
    
    [CVE-2026-64643](https://www.cve.org/CVERecord?id=CVE-2026-64643) / [GHSA-955p-x3mx-jcvp](https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp) — Unauthenticated disclosure of internal Server Function endpoints
    
    Medium
    
    ≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11
    
    ## Impact on Netlify
    
    ### Server-side request forgery
    
    [CVE-2026-64645](https://www.cve.org/CVERecord?id=CVE-2026-64645) / [GHSA-p9j2-gv94-2wf4](https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4) (Server-Side Request Forgery in rewrites via attacker-controlled destination hostname): Netlify sites are **affected** if a `rewrites()` or `redirects()` rule builds the destination hostname from request input (static destinations are not). Upgrading Next.js resolves it.
    
    [CVE-2026-64649](https://www.cve.org/CVERecord?id=CVE-2026-64649) / [GHSA-89xv-2m56-2m9x](https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x) (Server-Side Request Forgery in Server Actions on custom servers): Netlify sites are **not affected** — our edge overwrites inbound `X-Forwarded-Host` with the real host, so an attacker cannot redirect the Server Action’s outbound request to a host they control.
    
    ### Middleware authorization bypass
    
    [CVE-2026-64642](https://www.cve.org/CVERecord?id=CVE-2026-64642) / [GHSA-6gpp-xcg3-4w24](https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24) (Middleware / Proxy bypass in App Router applications using Turbopack and single locale): Netlify sites are **affected** if they build with Turbopack and use the legacy `middleware.ts` convention with single-locale i18n. Webpack builds and the newer `proxy.ts` convention are not affected. Upgrading Next.js resolves it.
    
    ### Denial of service
    
    [CVE-2026-64641](https://www.cve.org/CVERecord?id=CVE-2026-64641) / [GHSA-m99w-x7hq-7vfj](https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj) (Denial of Service in App Router using Server Actions) and [CVE-2026-64646](https://www.cve.org/CVERecord?id=CVE-2026-64646) / [GHSA-4c39-4ccg-62r3](https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3) (Unbounded Server Action payload in Edge runtime) are server-side DoS. On Netlify these have **minimal impact**: our autoscaling architecture means a hung or crashed function does not affect other requests, though active exploitation could increase your function costs. The Edge-runtime OOM specifically **cannot exhaust memory on Netlify** — request bodies are capped and each request runs in an isolated invocation. Upgrading Next.js resolves both.
    
    [CVE-2026-64644](https://www.cve.org/CVERecord?id=CVE-2026-64644) / [GHSA-q8wf-6r8g-63ch](https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch) (Denial of Service in the Image Optimization API using SVGs): Netlify sites are **not affected** — `/_next/image` is served by [Netlify Image CDN](https://docs.netlify.com/build/image-cdn/overview/), so the vulnerable Next.js code path is not used.
    
    ### Cache disclosure / confusion
    
    [CVE-2026-64648](https://www.cve.org/CVERecord?id=CVE-2026-64648) / [GHSA-68g3-v927-f742](https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742) (Cache confusion of response bodies for requests with bodies) and [CVE-2026-64647](https://www.cve.org/CVERecord?id=CVE-2026-64647) / [GHSA-4633-3j49-mh5q](https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q) (Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences): Netlify sites are **affected** if they use the specific cached-fetch patterns — a cached `fetch(new Request(url), init)`, or a cached binary-body POST `fetch()`. `fetch(url, init)` and `cache: 'no-store'` are not affected. Upgrading Next.js resolves both.
    
    ### Information disclosure
    
    [CVE-2026-64643](https://www.cve.org/CVERecord?id=CVE-2026-64643) / [GHSA-955p-x3mx-jcvp](https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp) (Unauthenticated disclosure of internal Server Function endpoints): Netlify sites are **affected** (low impact) if they use Cache Components with a reflective Server Action co-bundled alongside a `use cache` function. The leak is limited to opaque internal function identifiers — no credentials or PII. Upgrading Next.js resolves it.
    
    ## What should I do?
    
    We strongly recommend upgrading as soon as possible:
    
    -   Upgrade `next` to **15.5.21** or **16.2.11**, then redeploy.
    
    For Next.js 13.x and 14.x: patches target 15.x / 16.x — upgrade to a patched minor.
    
    Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are [automatically deleted](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#automatic-deploy-deletion). Consider [deleting these deploys manually](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#manual-deploy-deletion-through-the-netlify-ui).
    
    ## Resources
    
    -   [Next.js July 2026 security release](https://nextjs.org/blog/july-2026-security-release)
    -   [Next.js security advisories](https://github.com/vercel/next.js/security)
    
    [Permalink to Security Update: Multiple vulnerabilities in Next.js Permalink](/changelog/2026-07-21-nextjs-security-vulnerabilities/)
    
-   [
    
    ## SAML provisioning upgrades for assigning default roles
    
    ](/changelog/2026-06-22-saml-provisioning-role-options/)
    
    June 22, 2026
    
    -   [security](/changelog/tag/security/)
    
    When you provision new users through SAML SSO, you now have more options for assigning a default role.
    
    Before this update, the Developer role was assigned by default. Now you can assign other roles with fewer permissions, such as [Reviewers](https://docs.netlify.com/manage/accounts-and-billing/team-management/roles-and-permissions/#reviewer) and [Internal Builders](https://docs.netlify.com/manage/accounts-and-billing/team-management/roles-and-permissions/#internal-builder).
    
    Learn more about your options for provisioning with [SAML SSO on Netlify](https://docs.netlify.com/manage/security/secure-netlify-access/configure-organization-saml-sso/).
    
    [Permalink to SAML provisioning upgrades for assigning default roles Permalink](/changelog/2026-06-22-saml-provisioning-role-options/)
    
-   [
    
    ## Security update: multiple vulnerabilities in React Router
    
    ](/changelog/2026-06-02-react-router-security-vulnerabilities/)
    
    June 2, 2026
    
    -   [security](/changelog/tag/security/)
    -   [remix](/changelog/tag/remix/)
    
    The React Router team has disclosed seven security vulnerabilities. Here’s what Netlify customers need to know.
    
    ## Vulnerabilities
    
    Vulnerability
    
    Package
    
    Affected versions
    
    Fixed in
    
    [GHSA-8x6r-g9mw-2r78](https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78) — DoS via `__manifest` endpoint
    
    `react-router`
    
    7.0.0–7.14.x
    
    7.15.0
    
    [GHSA-rxv8-25v2-qmq8](https://github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8) — DoS via single-fetch request body
    
    `react-router`
    
    7.0.0–7.13.x
    
    7.14.0
    
    [GHSA-8646-j5j9-6r62](https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62) — XSS via `javascript:` redirect in unstable RSC
    
    `react-router`
    
    7.7.0–7.13.1
    
    7.13.2
    
    [GHSA-49rj-9fvp-4h2h](https://github.com/remix-run/react-router/security/advisories/GHSA-49rj-9fvp-4h2h) — RCE when chained with prototype pollution
    
    `react-router`
    
    7.5.2–7.14.1
    
    7.14.2
    
    [GHSA-2j2x-hqr9-3h42](https://github.com/remix-run/react-router/security/advisories/GHSA-2j2x-hqr9-3h42) — Protocol-relative open redirect
    
    `react-router`
    
    7.0.0–7.14.0
    
    7.14.1
    
    [GHSA-f22v-gfqf-p8f3](https://github.com/remix-run/react-router/security/advisories/GHSA-f22v-gfqf-p8f3) — Stored XSS in prerendered redirect HTML
    
    `@react-router/dev`
    
    7.0.0–7.13.1
    
    7.13.2
    
    [GHSA-84g9-w2xq-vcv6](https://github.com/remix-run/react-router/security/advisories/GHSA-84g9-w2xq-vcv6) — CSRF check bypassed for PUT/PATCH/DELETE
    
    `react-router`
    
    7.12.0–7.15.0
    
    7.15.1
    
    ## Impact on Netlify
    
    ### GHSA-8x6r-g9mw-2r78 and GHSA-rxv8-25v2-qmq8 (denial of service)
    
    These are server-side denial-of-service (DoS) vulnerabilities. **On Netlify, these have minimal impact**: our autoscaling serverless architecture means that a malicious request resulting in a crashed or hung function does not affect other requests. However, active exploitation could increase your function costs.
    
    ### GHSA-8646-j5j9-6r62 (XSS in unstable RSC)
    
    This vulnerability affects apps using the experimental `unstable_*` RSC APIs where an attacker can control a redirect target. Only apps using these unstable APIs are affected.
    
    **Regardless of hosting provider, affected apps passing untrusted input into RSC redirect calls may be vulnerable.**
    
    ### GHSA-49rj-9fvp-4h2h (RCE when chained)
    
    **This vulnerability is not directly exploitable against React Router alone.** Reaching the vulnerable code path requires the application to first be independently vulnerable to a prototype pollution attack.
    
    ### GHSA-2j2x-hqr9-3h42 (open redirect)
    
    Apps that redirect users to attacker-supplied URLs with the intent to restrict them to the same origin may inadvertently allow protocol-relative redirects to external origins.
    
    **Regardless of hosting provider, all affected apps passing untrusted input to `redirect()` may be vulnerable.**
    
    ### GHSA-f22v-gfqf-p8f3 (stored XSS in prerendering)
    
    This vulnerability affects apps using the prerendering feature (`prerender: [...]` in `react-router.config.ts`). If any redirect target baked into a prerendered build originates from external or attacker-controlled data, the static artifact remains affected until a fresh build is run with a patched version.
    
    **Regardless of hosting provider, all affected apps using prerendering with externally sourced redirect targets may be vulnerable.**
    
    ### GHSA-84g9-w2xq-vcv6 (CSRF bypass for PUT/PATCH/DELETE)
    
    The CSRF origin check introduced in React Router 7.12.0 only applied to `POST` requests on the document-request path, leaving `PUT`, `PATCH`, and `DELETE` unchecked. In practice, exploitation additionally requires the app to have explicitly opened CORS for those methods and to be issuing session cookies with `SameSite=None`.
    
    **Regardless of hosting provider, this only poses a meaningful risk in apps with permissive cross-origin configurations.**
    
    ## What should I do?
    
    We strongly recommend upgrading as soon as possible to patched releases:
    
    -   `react-router` 7.15.1 or later
    -   `@react-router/dev` 7.13.2 or later (if using prerendering)
    
    If your app uses prerendering, trigger a fresh build after upgrading to regenerate any affected static assets.
    
    Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are [automatically deleted](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#automatic-deploy-deletion). Consider [deleting these deploys manually](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#manual-deploy-deletion-through-the-netlify-ui).
    
    [Permalink to Security update: multiple vulnerabilities in React Router Permalink](/changelog/2026-06-02-react-router-security-vulnerabilities/)
    
-   [
    
    ## Security update: multiple vulnerabilities in Nuxt
    
    ](/changelog/2026-05-19-nuxt-security-vulnerabilities/)
    
    May 19, 2026
    
    -   [security](/changelog/tag/security/)
    -   [nuxt.js](/changelog/tag/nuxt-js/)
    
    The Nuxt team has disclosed four security vulnerabilities. Here’s what Netlify customers need to know.
    
    ## Vulnerabilities
    
    -   [**CVE-2026-47200**](https://github.com/nuxt/nuxt/security/advisories/GHSA-hg3f-28rg-4jxj): Route middleware bypass via island page endpoints (nuxt 3.11.0–3.21.5, 4.0.0-alpha.1–4.4.5)
    -   [**CVE-2026-46342**](https://github.com/nuxt/nuxt/security/advisories/GHSA-g8wj-3cr3-6w7v): Island response not validated against request props (nuxt 3.1.0–3.21.5, 4.0.0-alpha.1–4.4.5)
    -   [**CVE-2026-45670**](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g): Dev server exposes built source over LAN (nuxt 3.15.4–3.21.5, 4.0.0-alpha.1–4.4.5)
    -   [**CVE-2026-45669**](https://github.com/nuxt/nuxt/security/advisories/GHSA-fx6j-w5w5-h468): Reflected XSS via `navigateTo` with `external: true` (nuxt 3.4.3–3.21.5, 4.0.0-alpha.1–4.4.5)
    
    ## Impact on Netlify
    
    ### CVE-2026-47200 (route middleware bypass)
    
    When component islands are enabled — the default in Nuxt 4, and available via an opt-in flag in Nuxt 3 — `.server.vue` page files are accessible via `/__nuxt_island/page_*` endpoints that render pages without invoking Vue Router, bypassing route middleware entirely. An unauthenticated attacker can request these endpoints directly to access pages that rely solely on middleware for access control.
    
    **Regardless of hosting provider, all affected Nuxt apps using `.server.vue` pages with route-middleware-only authentication are vulnerable.**
    
    ### CVE-2026-46342 (island cache poisoning)
    
    The `/__nuxt_island/*` endpoint accepts props via query parameters without server-side hash validation, allowing the same path to return different content depending on query parameters. If an upstream cache keys on path only, an attacker can inject crafted props into cached responses — enabling XSS if the application renders those props through unsafe HTML sinks.
    
    On Netlify, [cached function responses vary by query string](https://docs.netlify.com/build/caching/caching-overview/#default-caching-behavior). **This vulnerability requires overriding Netlify’s default `Netlify-Vary` behavior and is not exploitable in standard Netlify deployments.**
    
    ### CVE-2026-45670 (dev server source exposure)
    
    Running `nuxt dev --host` binds the development server to a non-loopback address; with the rspack or webpack builder (not the default Vite builder), malicious sites on the same network can access the application’s source code. This only affects local development environments.
    
    **Netlify production deployments are not affected.** Developers should avoid using `--host` with rspack or webpack builders, or upgrade to patch the issue.
    
    ### CVE-2026-45669 (reflected XSS via `navigateTo`)
    
    When `navigateTo()` is called with `external: true`, Nuxt generates a server-side HTML meta-refresh redirect. The destination URL is insufficiently sanitized — HTML-significant characters are not encoded, so an attacker who controls the URL parameter can inject arbitrary scripts that execute before the redirect occurs.
    
    **Regardless of hosting provider, all apps passing untrusted user input to `navigateTo()` with `external: true` are vulnerable.**
    
    ## What should I do?
    
    We strongly recommend upgrading as soon as possible to patched releases:
    
    -   `nuxt` 3.21.6 or later (for Nuxt 3.x), or 4.4.6 or later (for Nuxt 4.x)
    -   `@nuxt/rspack-builder` and `@nuxt/webpack-builder` 3.21.6 or later, or 4.4.6 or later (if applicable)
    
    Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are [automatically deleted](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#automatic-deploy-deletion). Consider [deleting these deploys manually](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#manual-deploy-deletion-through-the-netlify-ui).
    
    ## Resources
    
    -   [Nuxt security advisories](https://github.com/nuxt/nuxt/security)
    
    [Permalink to Security update: multiple vulnerabilities in Nuxt Permalink](/changelog/2026-05-19-nuxt-security-vulnerabilities/)
    
-   [
    
    ## Block project transfers out of your team
    
    ](/changelog/2026-05-08-block-project-transfers/)
    
    May 8, 2026
    
    -   [security](/changelog/tag/security/)
    -   [workflow](/changelog/tag/workflow/)
    
    Team Owners can now guarantee that projects stay within the team to meet compliance or ownership requirements by blocking every project from being transferred to another team.
    
    Once a Team Owner blocks project transfers out of the team, even the Team Owner cannot transfer projects out of the team unless they change this setting, which is tracked in the team’s audit log.
    
    ## Try it out
    
    To change the setting, go to **Team settings > Access & security > Transfer site settings** and select **Edit settings**.
    
    ![Transfer project settings panel showing Allowed and Blocked options for project transfers](/images/changelog/block-project-transfers-setting.png)
    
    When transfers are blocked, the **Transfer project** action is hidden for every project owned by the team and the backend rejects transfer requests for those projects.
    
    ## Enterprise defaults
    
    Enterprise teams start with project transfers set to **Blocked** for security reasons, but Team Owners can change this setting to **Allowed** at any time. Only Team Owners can change this setting and changes are recorded in the team audit log.
    
    ## Learn more
    
    Learn more in our docs on [Transferring a project](https://docs.netlify.com/manage/accounts-and-billing/team-management/team-owned-sites/).
    
    [Permalink to Block project transfers out of your team Permalink](/changelog/2026-05-08-block-project-transfers/)
    
-   [
    
    ## Security Update: Multiple vulnerabilities in Next.js and React
    
    ](/changelog/2026-05-08-react-nextjs-security-vulnerabilities/)
    
    May 8, 2026
    
    -   [security](/changelog/tag/security/)
    -   [next.js](/changelog/tag/next-js/)
    
    The Next.js and React teams have disclosed [twelve security vulnerabilities](https://github.com/vercel/next.js/security): one in React Server Components and eleven in Next.js, all patched on May 6, 2026, plus a follow-up advisory on May 7. The issues span middleware/proxy bypass, cross-site scripting (XSS), server-side request forgery (SSRF), cache poisoning, and denial of service (DoS). No detailed proof-of-concept information has been published. Here’s what Netlify customers need to know.
    
    ## Summary
    
    If you run Next.js on Netlify, **we strongly recommend upgrading `next` to 15.5.18 or 16.2.6** and redeploying. This also brings in the patched React Server Components dependency. Projects using Pages Router with i18n and Next.js Middleware / Proxy also need [OpenNext Netlify Next.js adapter v5.15.11](https://github.com/opennextjs/opennextjs-netlify/releases/tag/v5.15.11). If you use `react-server-dom-*` outside of Next.js, upgrade to 19.0.6 / 19.1.7 / 19.2.6 matching your React minor. See [What should I do?](#what-should-i-do) for full steps.
    
    Netlify’s platform is **not** vulnerable to several of these CVEs. Image Optimization, WebSocket SSRF, RSC cache poisoning, and the cache-poisoned-redirect bypass do not affect Netlify projects. See [Impact on Netlify](#impact-on-netlify) for the per-CVE verdict.
    
    ## Vulnerabilities
    
    ### React (`react-server-dom-*`)
    
    This affects `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack`. The Next.js advisory [GHSA-8h8q-6873-q5fj](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj) tracks the same issue downstream.
    
    Vulnerability
    
    Severity
    
    Affected versions
    
    Fixed in
    
    [GHSA-rv78-f8rc-xrxh](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh) — DoS in Server Components ([CVE-2026-23870](https://www.cve.org/CVERecord?id=CVE-2026-23870))
    
    High
    
    19.0.0–19.0.5, 19.1.0–19.1.6, 19.2.0–19.2.5
    
    19.0.6, 19.1.7, 19.2.6
    
    ### Next.js
    
    All Next.js issues are patched in **15.5.18** and **16.2.6**. Earlier minors of 15.x and 16.x will not be patched; affected projects must upgrade to a patched minor.
    
    Vulnerability
    
    Severity
    
    Affected versions
    
    [GHSA-8h8q-6873-q5fj](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj) — DoS with Server Components
    
    High
    
    ≥13.0.0
    
    [GHSA-267c-6grr-h53f](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) — Middleware / Proxy bypass in App Router via segment-prefetch routes
    
    High
    
    ≥15.2.0
    
    [GHSA-26hh-7cqf-hhc6](https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6) — Follow-up to [GHSA-267c-6grr-h53f](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f): incomplete fix for `middleware.ts` with Turbopack
    
    High
    
    ≥15.2.0
    
    [GHSA-mg66-mrh9-m8jx](https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx) — DoS via connection exhaustion in apps using Cache Components
    
    High
    
    ≥15.0.0 (apps using Cache Components)
    
    [GHSA-492v-c6pp-mqqv](https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv) — Middleware / Proxy bypass through dynamic route parameter injection
    
    High
    
    ≥15.4.0
    
    [GHSA-c4j6-fc7j-m34r](https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r) — SSRF in applications using WebSocket upgrades
    
    High
    
    ≥13.4.13
    
    [GHSA-36qx-fr4f-26g5](https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5) — Middleware / Proxy bypass in Pages Router applications using i18n
    
    High
    
    ≥12.2.0
    
    [GHSA-ffhc-5mcf-pf4q](https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q) — XSS in App Router applications using CSP nonces
    
    Medium
    
    ≥13.4.0
    
    [GHSA-gx5p-jg67-6x7h](https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h) — XSS in `beforeInteractive` scripts with untrusted input
    
    Medium
    
    ≥13.0.0
    
    [GHSA-h64f-5h5j-jqjh](https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh) — DoS in the Image Optimization API
    
    Medium
    
    ≥10.0.0
    
    [GHSA-wfc6-r584-vfw7](https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7) — Cache poisoning in React Server Component responses
    
    Medium
    
    ≥14.2.0
    
    [GHSA-vfv6-92ff-j949](https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949) — Cache poisoning via collisions in React Server Component cache-busting
    
    Low
    
    ≥13.4.6
    
    [GHSA-3g8h-86w9-wvmq](https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq) — Middleware / Proxy redirects can be cache-poisoned
    
    Low
    
    ≥12.2.0
    
    ## Impact on Netlify
    
    ### Denial of service
    
    [GHSA-8h8q-6873-q5fj](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj) and [GHSA-mg66-mrh9-m8jx](https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx) are server-side denial-of-service (DoS) vulnerabilities. On Netlify, these have **minimal impact**: our autoscaling serverless architecture means that a malicious request resulting in a crashed or hung function does not affect other requests. However, active exploitation could increase your function costs. Note that Cache Components ([GHSA-mg66-mrh9-m8jx](https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx)) is an opt-in Next.js feature that is not enabled by default. Upgrading Next.js resolves both.
    
    [GHSA-h64f-5h5j-jqjh](https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh) affects the Next.js Image Optimization API. Netlify projects are **not affected**: this Next.js code path is not used on Netlify — image optimization is handled by [Netlify Image CDN](https://docs.netlify.com/build/image-cdn/overview/), a separate service that runs outside your project’s functions with its own protections against this class of issue.
    
    ### Middleware / proxy bypass
    
    These four CVEs affect Next.js middleware and proxy routing. Because Netlify runs Next.js middleware via our own edge function adapter, the impact varies per CVE:
    
    -   [GHSA-3g8h-86w9-wvmq](https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq) (cache-poisoned redirects): Netlify projects are **not affected**. Our OpenNext Netlify Next.js adapter already varies cached responses on the `x-nextjs-data` header.
    -   [GHSA-492v-c6pp-mqqv](https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv) (dynamic route parameter injection): Netlify projects are **affected**, and the upstream Next.js fix applies. Upgrading Next.js resolves the issue.
    -   [GHSA-36qx-fr4f-26g5](https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5) (Pages Router i18n bypass): Netlify projects using Pages Router with i18n and Next.js Middleware / Proxy are **affected**. The upstream Next.js patch alone does not resolve this on Netlify; a Netlify-specific fix shipped in [OpenNext Netlify Next.js adapter v5.15.11](https://github.com/opennextjs/opennextjs-netlify/releases/tag/v5.15.11). See [how to upgrade](#what-should-i-do) below.
    -   [GHSA-267c-6grr-h53f](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) (App Router segment-prefetch bypass) and [GHSA-26hh-7cqf-hhc6](https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6) (follow-up): Netlify projects are **affected**, and the upstream Next.js fix applies. Upgrading Next.js resolves both.
    
    ### Cross-site scripting
    
    [GHSA-ffhc-5mcf-pf4q](https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q) and [GHSA-gx5p-jg67-6x7h](https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h) are client-side XSS vulnerabilities. Regardless of hosting provider, all apps using CSP nonces in App Router or passing untrusted input to `beforeInteractive` scripts may be **vulnerable**. Upgrade Next.js to remediate.
    
    ### Server-side request forgery
    
    [GHSA-c4j6-fc7j-m34r](https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r) affects applications using WebSocket upgrades. Netlify projects are **not affected**: Netlify Functions and Edge Functions do not support WebSocket upgrades, so this Next.js code path cannot be exercised on Netlify.
    
    ### Cache poisoning
    
    [GHSA-wfc6-r584-vfw7](https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7) and [GHSA-vfv6-92ff-j949](https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949) affect React Server Component response caching. Netlify projects are **not affected**: Netlify’s CDN does not rely on the `_rsc` cache-busting query parameter (so collisions in it cannot poison cache entries), and it honors `Vary` on RSC-related request headers.
    
    ## What should I do?
    
    We strongly recommend upgrading as soon as possible to patched releases:
    
    -   **Next.js projects:** upgrade `next` to 15.5.18 or 16.2.6. This bundles the patched React Server Components dependency, so a separate `react-server-dom-*` upgrade is not needed.
    -   **Direct `react-server-dom-*` users** (React Router RSC, Vite RSC plugin, custom RSC setups): upgrade `react-server-dom-webpack`, `react-server-dom-parcel`, or `react-server-dom-turbopack` to 19.0.6, 19.1.7, or 19.2.6 — matching your React minor.
    
    For Next.js 13.x and 14.x users: patches are not planned for these versions. Consider upgrading to Next.js 15.x or 16.x.
    
    For projects using Pages Router with i18n and Next.js Middleware / Proxy ([GHSA-36qx-fr4f-26g5](https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5)), the upstream Next.js fix does not fully apply on Netlify. The fix ships in [OpenNext Netlify Next.js adapter v5.15.11](https://github.com/opennextjs/opennextjs-netlify/releases/tag/v5.15.11):
    
    -   Auto-installed adapter (default): redeploy.
    -   Manually installed adapter: upgrade `@netlify/plugin-nextjs` to v5.15.11 and redeploy. We recommend [not pinning the adapter version](https://docs.netlify.com/build/frameworks/framework-setup-guides/nextjs/overview/#how-netlify-runs-your-nextjs-app) so future fixes ship automatically.
    
    Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are [automatically deleted](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#automatic-deploy-deletion). Consider [deleting these deploys manually](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#manual-deploy-deletion-through-the-netlify-ui).
    
    ## Resources
    
    -   [React security advisory (GHSA-rv78-f8rc-xrxh)](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh)
    -   [CVE-2026-23870](https://www.cve.org/CVERecord?id=CVE-2026-23870)
    -   [Next.js security advisories](https://github.com/vercel/next.js/security)
    
    [Permalink to Security Update: Multiple vulnerabilities in Next.js and React Permalink](/changelog/2026-05-08-react-nextjs-security-vulnerabilities/)
    
-   [
    
    ## Security Update: DoS vulnerability in Next.js and React Server Components
    
    ](/changelog/2026-04-08-react-nextjs-dos-vulnerability/)
    
    April 8, 2026
    
    -   [security](/changelog/tag/security/)
    -   [next.js](/changelog/tag/next-js/)
    
    A denial-of-service (DoS) vulnerability ([CVE-2026-23869](https://www.cve.org/CVERecord?id=CVE-2026-23869), CVSS 7.5) has been disclosed affecting React Server Components (RSCs), a feature used by Next.js and other React metaframeworks. A malicious payload can cause excessive CPU consumption. Here’s what Netlify customers need to know.
    
    ## Impact on Netlify
    
    Nominally, this is a server-side DoS vulnerability. However, **on Netlify this has minimal impact**: our autoscaling serverless architecture means that a malicious request resulting in a crashed or hung function does not affect other requests. However, active exploitation could increase your function costs.
    
    ## Affected frameworks
    
    All RSC frameworks are affected:
    
    -   **Next.js** (see version table below)
    -   React Router 7 (if using RSC preview)
    -   Waku
    -   `@parcel/rsc`
    -   `@vitejs/plugin-rsc`
    
    Astro, Gatsby, and Remix are not affected.
    
    ### React affected versions
    
    See the [React advisory](https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg) for full details.
    
    Affected versions
    
    Fixed in
    
    19.0.0–19.0.4
    
    19.0.5
    
    19.1.0–19.1.5
    
    19.1.6
    
    19.2.0–19.2.4
    
    19.2.5
    
    ### Next.js affected versions
    
    See the [Next.js advisory](https://github.com/vercel/next.js/security/advisories/GHSA-q4gf-8mx6-v5v3) for full details.
    
    Affected versions
    
    Fixed in
    
    13.3.0+
    
    EOL - no fix
    
    14.x
    
    EOL - no fix
    
    15.0.0–15.5.14
    
    15.5.15
    
    16.0.0–16.2.2
    
    16.2.3
    
    ## What should I do?
    
    If any of your projects are using an affected version, we recommend upgrading as soon as possible to a patched release.
    
    For Next.js 13.x and 14.x users: patches are not planned for these versions. Consider upgrading to Next.js 15.x or 16.x.
    
    Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are [automatically deleted](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#automatic-deploy-deletion). Consider [deleting these deploys manually](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#manual-deploy-deletion-through-the-netlify-ui).
    
    ## Resources
    
    -   [React CVE-2026-23869](https://www.cve.org/CVERecord?id=CVE-2026-23869)
    -   [React security advisory](https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg)
    -   [Next.js security advisory](https://github.com/vercel/next.js/security/advisories/GHSA-q4gf-8mx6-v5v3)
    
    [Permalink to Security Update: DoS vulnerability in Next.js and React Server Components Permalink](/changelog/2026-04-08-react-nextjs-dos-vulnerability/)
    

[Next page](/changelog/tag/security/page/2)