UpHeron
All vulnerabilities

npm

GHSA-5j59-xgg2-r9c4

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

Severity
High 7.5
Published
12 Dec 2025
Last changed
10 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
15.3.8, 15.4.10, 15.5.9, 15.6.0-canary.60, 16.0.10, 16.1.0-canary.19
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 16.1.0-canary.17 before 16.1.0-canary.19
  • From 16.0.9 before 16.0.10
  • From 15.6.0-canary.59 before 15.6.0-canary.60
  • From 15.5.8 before 15.5.9
All 10 release lines
  • From 13.3.1-canary.0 before 14.2.35
  • From 15.0.6 before 15.0.7
  • From 15.1.10 before 15.1.11
  • From 15.2.7 before 15.2.8
  • From 15.3.7 before 15.3.8
  • From 15.4.9 before 15.4.10
  • From 15.5.8 before 15.5.9
  • From 15.6.0-canary.59 before 15.6.0-canary.60
  • From 16.0.9 before 16.0.10
  • From 16.1.0-canary.17 before 16.1.0-canary.19

References