Netlify Issues Security Guidance Following Next.js and React Vulnerability Disclosures.

The Next.js and React teams disclosed twelve security vulnerabilities on May 6, 2026, spanning middleware bypass, cross-site scripting, server-side request forgery, cache poisoning, and denial of service. One vulnerability affects React Server Components, while eleven target Next.js itself. Netlify responded May 8 with specific guidance for developers running Next.js on its platform, clarifying which CVEs affect hosted projects and which do not.

Netlify recommends upgrading Next.js to version 15.5.18 or 16.2.6 and redeploying. This update pulls in the patched React Server Components dependency automatically. For projects using Pages Router with internationalization and Next.js Middleware or Proxy, developers must also update the OpenNext Netlify Next.js adapter to version 5.15.11. Projects with auto-installed adapters only require a redeploy.

Netlify's platform architecture eliminates exposure to four of the disclosed vulnerabilities. The Image Optimization denial of service, WebSocket server-side request forgery, React Server Components cache poisoning, and cache-poisoned redirect bypass do not affect projects deployed on Netlify.

The platform's build and runtime infrastructure handles image optimization differently than standard Next.js deployments, preventing the DoS vector. WebSocket routing on Netlify bypasses the vulnerable Next.js middleware layer, while caching behavior for Server Components follows a distinct pattern that sidesteps the poisoning attack described in the React advisory. The redirect bypass, which relies on manipulating Next.js cache headers, similarly fails against Netlify's edge routing.

Seven Next.js vulnerabilities and the React Server Components DoS remain relevant to Netlify-hosted projects. These include middleware and proxy bypass issues, multiple cross-site scripting vectors, and server-side request forgery paths that could allow attackers to access internal resources or inject malicious content.

The React advisory GHSA-rv78-f8rc-xrxh describes a denial of service condition in react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack affecting React 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5. Developers using these packages outside Next.js must upgrade to 19.0.6, 19.1.7, or 19.2.6 depending on their minor version.

No proof-of-concept exploits have been published. The Next.js team assigned severity ratings ranging from moderate to high, with the React DoS rated high. Earlier minor versions of Next.js 15.x and 16.x will not receive patches; affected projects must upgrade to a supported minor release.

Netlify's full security update breaks down each CVE with specific impact assessments and mitigation steps for its platform.