A high-severity denial-of-service vulnerability in React Server Components can allow attackers to stall vulnerable Next.js ...

A high-severity vulnerability in React Server Components can allow unauthenticated attackers to overwhelm vulnerable Next. js servers through specially crafted HTTP requests, potentially making ...

Next.js patches two critical RCE flaws involving typed arrays and SVG processing, plus a Server Actions DoS affecting App ...

The RondoDox botnet has been observed exploiting the critical React2Shell flaw (CVE-2025-55182) to infect vulnerable Next.js servers with malware and cryptominers. First documented by Fortinet in July ...

A high-severity React Server Components DoS flaw lets attackers freeze vulnerable Next.js servers with crafted POST requests.

Next.js ImageResponse flaw can lead to server code execution when attacker-controlled values reach generated SVG.