HoneyWarden
highnextGHSA-h25m-26qc-wcjf

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

Affected versions

  • >= 13.0.0, < 15.0.8, fixed in 15.0.8
  • >= 15.1.1-canary.0, < 15.1.12, fixed in 15.1.12
  • >= 15.2.0-canary.0, < 15.2.9, fixed in 15.2.9
  • >= 15.3.0-canary.0, < 15.3.9, fixed in 15.3.9
  • >= 15.4.0-canary.0, < 15.4.11, fixed in 15.4.11
  • >= 15.5.1-canary.0, < 15.5.10, fixed in 15.5.10
  • >= 15.6.0-canary.0, < 15.6.0-canary.61, fixed in 15.6.0-canary.61
  • >= 16.0.0-beta.0, < 16.0.11, fixed in 16.0.11
  • >= 16.1.0-canary.0, < 16.1.5, fixed in 16.1.5

Published 2026-01-28. Last checked 2026-11-01. Read the source advisory

Scan your site for free