Security Update: DoS vulnerability in Next.js and React Server Components
PreviewUnverifiedAdded Sep 24, 2026
A denial-of-service (DoS) vulnerability (CVE-2026-23869, CVSS 7.5) has been disclosed affecting React Server Components (RSCs), a feature used by Next.js and other React metaframeworks. A malicious payload can cause excessive CPU consumption. Here's what Netlify customers need to know. Impact on Netlify Nominally, this is a server-side DoS vulnerability.
Topics: Security, Pricing, Developer tools
More Netlify releases
Every Netlify release| Date | Release | Type |
|---|---|---|
| Apr 6 | Deploy logs streaming is now fasterunverified Update | Update |
| Apr 13 | Netlify Database GA coming soon, no new databases for nowunverified GA | GA |
| Apr 14 | New sorting and filter controls on the Members pageunverified Update | Update |
| Apr 14 | Free unlimited seats on Pro, unlimited form submissions, & updated credit ratesunverified Pricing | Pricing |
| Apr 16 | Claude Opus 4.7 now available in AI Gateway and Agent Runnersunverified Update | Update |
| Mar 31 | Netlify CLI adds prompt-based creation and anonymous deploysunverified Update | Update |
| Apr 17 | New frontend-design skill for Agent Runnersunverified Update | Update |
| Mar 27 | Deploy from Codex with the Netlify Pluginunverified Preview | Preview |
Also shipped on Apr 8, 2026
Netlify in April 2026| Date | Company | Release | Product | Type |
|---|---|---|---|---|
| Apr 8 |  Tailscale | New pricing and packagingunverified | Tailscale | Pricing |
| Apr 8 |  Okta | Multiple Custom Domains General Availabilityunverified | Auth0 | GA |
| Apr 8 |  Grafana Labs | Dynamic dashboards is now generally availableunverified | Grafana Cloud | GA |
| Apr 8 | Grafana Labs | Manage and use secrets in Grafana Cloud k6unverified | Grafana Cloud | Preview |
| Apr 8 |  Deepgram | Reusable agent configurationsunverified | Deepgram | Update |
| Apr 8 |  Chroma | Chroma 1.5.7unverified | Chroma | Update |
Sources: each vendor's own release notes, changelogs and GitHub releases, read daily to monthly by how often it posts. Logos via logo.dev; trademarks belong to their owners.