@emstack/nextjs-cve-2026-23870-checker

CLI checker and fixer for all 13 vulnerabilities in the Next.js May 2026 Security Release, including CVE-2026-23870 (DoS in React Server Components).

Quickstart

# Interactive mode (recommended)
npx @emstack/nextjs-cve-2026-23870-checker

# Check a project
npx @emstack/nextjs-cve-2026-23870-checker ~/my-app

# Fix
npx @emstack/nextjs-cve-2026-23870-checker ~/my-app --fix

Covered Advisories

| ID | Severity | Description | |----|----------|-------------| | GHSA-8h8q-6873-q5fj | High | CVE-2026-23870 — DoS in React Server Components | | GHSA-267c-6grr-h53f | High | Segment-prefetch URL authorization bypass in App Router | | GHSA-26hh-7cqf-hhc6 | High | Incomplete fix follow-up for segment-prefetch bypass | | GHSA-36qx-fr4f-26g5 | High | i18n default-locale path circumvents proxy authorization | | GHSA-492v-c6pp-mqqv | High | Dynamic route parameter injection enables bypass | | GHSA-mg66-mrh9-m8jx | High | Connection exhaustion affecting Cache Components | | GHSA-c4j6-fc7j-m34r | High | SSRF via WebSocket upgrade request | | GHSA-h64f-5h5j-jqjh | Moderate | Image Optimization API exploitation (DoS) | | GHSA-wfc6-r584-vfw7 | Moderate | RSC response poisoning (cache) | | GHSA-ffhc-5mcf-pf4q | Moderate | CSP nonce leakage in App Router | | GHSA-gx5p-jg67-6x7h | Moderate | XSS via untrusted input in beforeInteractive scripts | | GHSA-3g8h-86w9-wvmq | Low | Cache poisoning via middleware redirects | | GHSA-vfv6-92ff-j949 | Low | Cache-busting collision vulnerability |

Affected Versions

| Package | Vulnerable | Patched | |---------|-----------|---------| | next 13.x, 14.x | All versions | Upgrade to 15.5.18 or 16.2.6 | | next 15.x | ≤ 15.5.17 | 15.5.18 | | next 16.x | ≤ 16.2.5 | 16.2.6 | | react-server-dom-* 19.0.x | ≤ 19.0.5 | 19.0.6 | | react-server-dom-* 19.1.x | ≤ 19.1.6 | 19.1.7 | | react-server-dom-* 19.2.x | ≤ 19.2.5 | 19.2.6 |

Checked react-server-dom-* packages: webpack, turbopack, bun, esm, deno.

Note: Patching is the only complete mitigation. WAF-level protection is unavailable for these vulnerabilities.

Usage

Interactive mode

Launched by default when no arguments are given. Walks a root directory to discover Next.js projects, lets you pick which ones to scan, and optionally applies fixes.

npx @emstack/nextjs-cve-2026-23870-checker
npx @emstack/nextjs-cve-2026-23870-checker -i

Check a project

npx @emstack/nextjs-cve-2026-23870-checker /path/to/your/nextjs-app

Exits with code 1 if vulnerabilities are found — CI-safe.

Check multiple projects

npx @emstack/nextjs-cve-2026-23870-checker ~/app1 ~/app2 ~/app3

Prints a per-project report and a summary line at the end.

Preview fixes (no files written)

npx @emstack/nextjs-cve-2026-23870-checker ~/my-app --dry-run

Apply fixes

Updates package.json and runs the appropriate install command (bun, pnpm, yarn, or npm — auto-detected from lockfile).

npx @emstack/nextjs-cve-2026-23870-checker ~/my-app --fix

# Fix multiple projects at once
npx @emstack/nextjs-cve-2026-23870-checker ~/app1 ~/app2 --fix

JSON output

npx @emstack/nextjs-cve-2026-23870-checker ~/my-app --json

All options

Usage:
  npx @emstack/nextjs-cve-2026-23870-checker [path...] [options]

Arguments:
  path                   Project path(s) to scan (default: .)

Options:
  -i, --interactive      Interactive mode (default when no args given)
  --fix                  Update package.json and run install
  --dry-run              Show what would change without writing files
  --json                 Output results as JSON
  --help, -h             Show this help

Development

bun install
bun run dev /path/to/your/nextjs-app
bun run build   # produces dist/cli.js

Example Output

Next.js May 2026 Security Release — 13 advisories

Scanning: /my-app
  ✗ Found 2 vulnerable package(s):

    next
    Installed: ^15.3.0  →  Fix: 15.5.18
    Advisories (13):
      [High] [CVE-2026-23870] GHSA-8h8q-6873-q5fj — DoS in React Server Components
      [High] GHSA-267c-6grr-h53f — Segment-prefetch URL authorization bypass in App Router
      ...

    react-server-dom-webpack
    Installed: ^19.1.5  →  Fix: 19.1.7
    Advisories (2):
      [High] [CVE-2026-23870] GHSA-8h8q-6873-q5fj — DoS in React Server Components
      [Moderate] GHSA-wfc6-r584-vfw7 — RSC response poisoning (cache)

  Patching is the only complete mitigation. WAF-level protection unavailable.
  Source: https://vercel.com/changelog/next-js-may-2026-security-release

  Run with --fix to update package.json and install patched versions.

License

MIT