Issue Station
Sign In
Tools hereToolbox

nextjs - ✅(Solved) Fix [Dependencies] Update version of dependencies to fix vulnerabilities [4 pull requests, 5 comments, 4 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
vercel/next.js#91890•Fetched 2026-04-08 01:25:52
View on GitHub
Comments
5
Participants
4
Timeline
17
Reactions
0
Author
austsinovichaustsinovich
Participants
austsinovichaustsinovichchristopherjohnson3028-stackchristopherjohnson3028-stackhammadxcmhammadxcmicyJosephicyJoseph
Timeline (top)
commented ×5mentioned ×4subscribed ×4cross-referenced ×1

Fix Action

Fix / Workaround

https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg Here are some vulnerabilities in React packages. Could you update dependencies to patched versions for next v15?

PR fix notes

PR #91894: Sync React to c0d218f0 (Mar 24) — CVE-2026-23864

Description (problem / solution / changelog)

Summary

Syncs vendored React packages from 8b2e903a (Mar 20) to c0d218f0 (Mar 24), updating all canary and experimental channel packages.

Closes #91890

CVE-2026-23864 / GHSA-83fc-fqcc-2hmg — Verification

The reported vulnerability (DoS in React Server Components via specially crafted HTTP requests to Server Function endpoints) was fixed in facebook/react#35632 ("[Flight] Add more DoS mitigations to Flight Reply, and harden Flight"), merged 2026-01-26.

The canary commit c0d218f0 (Mar 24) is 128 commits ahead of the fix commit 10680271, confirming the fix is fully included. In fact, both the old (8b2e903a, Mar 20) and new canaries already contain the fix — it was merged nearly two months prior. This sync updates to the very latest canary for completeness.

Protections present in the vendored React RSC server code:

ProtectionDetail
Bound arguments limitServer Functions limited to 1,000 bound arguments
Array size / nesting limitDefault 1,000,000 total slots across nested arrays (_arraySizeLimit)
BigInt size limitRejects BigInt values exceeding 300 digits
__proto__ pollution guardsSkips/deletes __proto__ keys during deserialization at multiple points
then key poisoning preventioncreateModel() returns null for "then" function models
Plain object enforcementRejects non-plain objects (classes, null prototypes) in Server→Client serialization

Additional Next.js-level protections:

  • HTTP body size limit: default 1 MB, configurable via serverActions.bodySizeLimit
  • CSRF / origin validation with configurable allowedOrigins
  • Action ID validation (42-char length check + serverModuleMap lookup)
  • Header value length limiting for logs (100 chars)

Upstream React changes

diff facebook/[email protected]

Packages updated

  • react / react-dom / scheduler (canary + experimental)
  • react-server-dom-webpack / react-server-dom-turbopack (canary + experimental)
  • react-is

62 files changed across package.json, pnpm-lock.yaml, and packages/next/src/compiled/.

Test plan

  • CI passes (build, lint, types, tests)
  • No regressions in RSC e2e tests
  • Verify vendored server-dom packages contain DoS mitigations (bound args limit, array size limit, BigInt limit, proto guards)

Changed files

  • package.json (modified, +15/-15)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-client.development.js (modified, +8/-7)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-client.production.js (modified, +8/-6)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-profiling.development.js (modified, +8/-7)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-profiling.profiling.js (modified, +8/-6)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-server-legacy.browser.development.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-server-legacy.browser.production.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-server-legacy.node.development.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-server-legacy.node.production.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-server.browser.development.js (modified, +3/-3)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-server.browser.production.js (modified, +3/-3)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-server.bun.production.js (modified, +3/-3)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-server.edge.development.js (modified, +3/-3)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-server.edge.production.js (modified, +3/-3)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-server.node.development.js (modified, +3/-3)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-server.node.production.js (modified, +3/-3)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-unstable_testing.development.js (modified, +8/-7)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom-unstable_testing.production.js (modified, +8/-6)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom.development.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom.production.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom.react-server.development.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom-experimental/cjs/react-dom.react-server.production.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom-experimental/package.json (modified, +2/-2)
  • packages/next/src/compiled/react-dom/cjs/react-dom-client.development.js (modified, +8/-7)
  • packages/next/src/compiled/react-dom/cjs/react-dom-client.production.js (modified, +8/-6)
  • packages/next/src/compiled/react-dom/cjs/react-dom-profiling.development.js (modified, +8/-7)
  • packages/next/src/compiled/react-dom/cjs/react-dom-profiling.profiling.js (modified, +8/-6)
  • packages/next/src/compiled/react-dom/cjs/react-dom-server-legacy.browser.development.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom/cjs/react-dom-server-legacy.browser.production.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom/cjs/react-dom-server-legacy.node.development.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom/cjs/react-dom-server-legacy.node.production.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom/cjs/react-dom-server.browser.development.js (modified, +3/-3)
  • packages/next/src/compiled/react-dom/cjs/react-dom-server.browser.production.js (modified, +3/-3)
  • packages/next/src/compiled/react-dom/cjs/react-dom-server.bun.production.js (modified, +3/-3)
  • packages/next/src/compiled/react-dom/cjs/react-dom-server.edge.development.js (modified, +3/-3)
  • packages/next/src/compiled/react-dom/cjs/react-dom-server.edge.production.js (modified, +3/-3)
  • packages/next/src/compiled/react-dom/cjs/react-dom-server.node.development.js (modified, +3/-3)
  • packages/next/src/compiled/react-dom/cjs/react-dom-server.node.production.js (modified, +3/-3)
  • packages/next/src/compiled/react-dom/cjs/react-dom.development.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom/cjs/react-dom.production.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom/cjs/react-dom.react-server.development.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom/cjs/react-dom.react-server.production.js (modified, +1/-1)
  • packages/next/src/compiled/react-dom/package.json (modified, +2/-2)
  • packages/next/src/compiled/react-experimental/cjs/react.development.js (modified, +1/-1)
  • packages/next/src/compiled/react-experimental/cjs/react.production.js (modified, +1/-1)
  • packages/next/src/compiled/react-experimental/cjs/react.react-server.development.js (modified, +1/-1)
  • packages/next/src/compiled/react-experimental/cjs/react.react-server.production.js (modified, +1/-1)
  • packages/next/src/compiled/react-is/package.json (modified, +1/-1)
  • packages/next/src/compiled/react-server-dom-turbopack-experimental/cjs/react-server-dom-turbopack-client.browser.development.js (modified, +2/-2)
  • packages/next/src/compiled/react-server-dom-turbopack-experimental/package.json (modified, +2/-2)
  • packages/next/src/compiled/react-server-dom-turbopack/cjs/react-server-dom-turbopack-client.browser.development.js (modified, +2/-2)
  • packages/next/src/compiled/react-server-dom-turbopack/package.json (modified, +2/-2)
  • packages/next/src/compiled/react-server-dom-webpack-experimental/cjs/react-server-dom-webpack-client.browser.development.js (modified, +2/-2)
  • packages/next/src/compiled/react-server-dom-webpack-experimental/package.json (modified, +2/-2)
  • packages/next/src/compiled/react-server-dom-webpack/cjs/react-server-dom-webpack-client.browser.development.js (modified, +2/-2)
  • packages/next/src/compiled/react-server-dom-webpack/package.json (modified, +2/-2)
  • packages/next/src/compiled/react/cjs/react.development.js (modified, +1/-1)
  • packages/next/src/compiled/react/cjs/react.production.js (modified, +1/-1)
  • packages/next/src/compiled/react/cjs/react.react-server.development.js (modified, +1/-1)
  • packages/next/src/compiled/react/cjs/react.react-server.production.js (modified, +1/-1)
  • packages/next/src/compiled/unistore/unistore.js (modified, +1/-1)
  • pnpm-lock.yaml (modified, +919/-919)

Code Example

"next": "15.5.14",
"react": "19.1.5",
RAW_BUFFERClick to expand / collapse

Link to the code that reproduces this issue

https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg

To Reproduce

https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg Here are some vulnerabilities in React packages. Could you update dependencies to patched versions for next v15?

Current vs. Expected behavior

Current: AWS inspector shows vulnerabilities Expected: AWS inspector does not show vulnerabilities

Provide environment information

"next": "15.5.14",
"react": "19.1.5",

Which area(s) are affected? (Select all that apply)

React

Which stage(s) are affected? (Select all that apply)

Other (Deployed)

Additional context

No response

extent analysis

Fix Plan

To address the vulnerabilities in React packages, we need to update the dependencies to patched versions.

Step-by-Step Solution:

  • Update react to the latest version (at least 19.2.0) to fix known vulnerabilities.
  • Update next to the latest version (at least 15.6.0) to ensure compatibility with the updated react version.

Example Code Changes:

No code changes are required, only updates to package.json:

"next": "^15.6.0",
"react": "^19.2.0",

Run npm install or yarn install to update the dependencies.

Verification

After updating the dependencies, re-run the AWS inspector to verify that the vulnerabilities are no longer detected.

Extra Tips

Regularly check for updates to dependencies and update them to ensure the security and stability of your application. Use tools like npm audit or yarn audit to identify vulnerabilities in your dependencies.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#memory management#API rate limit#retriever error#indexing error#inference speed

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING