{"action":"Upgrade next to 15.0.8 or later.","affected":[{"fixed":"15.0.8","introduced":"13.0.0"},{"fixed":"15.1.12","introduced":"15.1.1-canary.0"},{"fixed":"15.2.9","introduced":"15.2.0-canary.0"},{"fixed":"15.3.9","introduced":"15.3.0-canary.0"},{"fixed":"15.4.11","introduced":"15.4.0-canary.0"},{"fixed":"15.5.10","introduced":"15.5.1-canary.0"},{"fixed":"15.6.0-canary.61","introduced":"15.6.0-canary.0"},{"fixed":"16.0.11","introduced":"16.0.0-beta.0"},{"fixed":"16.1.5","introduced":"16.1.0-canary.0"}],"component":"next","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["15.0.8","15.1.12","15.2.9","15.3.9","15.4.11","15.5.10","15.6.0-canary.61","16.0.11","16.1.5"],"ghsa_id":"GHSA-h25m-26qc-wcjf","id":"tcs_01M5KFSTWQ11G4M1XKN2QBE7DQ","modified_at":"2026-09-10T03:50:33.105717591Z","published_at":"2026-01-28T15:38:01Z","references":["https://osv.dev/vulnerability/GHSA-h25m-26qc-wcjf","https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg","https://github.com/vercel/next.js/security/advisories/GHSA-h25m-26qc-wcjf","https://nvd.nist.gov/vuln/detail/CVE-2026-23864","https://github.com/vercel/next.js","https://vercel.com/changelog/summary-of-cve-2026-23864"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-h25m-26qc-wcjf","url":"https://osv.dev/vulnerability/GHSA-h25m-26qc-wcjf"}],"summary":"Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components"}