← Blog
#Next.js#Security#Web Development#Vercel

Next.js May 2026 Security Release: 13 Advisories Explained

webhani·

Vercel released a coordinated security patch for Next.js this week, addressing 13 advisories in a single release. The vulnerability categories span denial of service, middleware and proxy bypass, server-side request forgery (SSRF), cache poisoning, and cross-site scripting (XSS). The official guidance is clear: patching is the only complete mitigation. WAF rules or configuration changes may reduce exposure but do not fully address the underlying issues.

Upgrade First

# Check your current version
npx next --version
 
# Upgrade to the latest patch
npm install next@latest
 
# Verify installed version
npm ls next

After upgrading, run your test suite in staging before deploying to production. The patch is primarily additive from a security standpoint, but confirm nothing in your application relies on the now-fixed behavior.

Middleware and Proxy Bypass

If you're using Next.js Middleware for authentication or authorization, this category deserves immediate attention. Certain request patterns could bypass Middleware under the affected versions, allowing access to protected routes without a valid session.

// middleware.ts
import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";
 
export function middleware(request: NextRequest) {
  const session = request.cookies.get("session-token");
 
  if (!session?.value) {
    return NextResponse.redirect(new URL("/login", request.url));
  }
 
  return NextResponse.next();
}
 
export const config = {
  matcher: ["/dashboard/:path*", "/api/private/:path*"]
};

This pattern itself is correct, but on unpatched versions, specific malformed requests could bypass this check entirely. If your application uses Middleware for auth, treat this upgrade as urgent.

Cache Poisoning

Applications using ISR (Incremental Static Regeneration) or the Next.js Data Cache are exposed to cache poisoning in affected versions. A cache poisoning attack writes malicious content into the cache, which is then served to legitimate users.

After upgrading, proactively revalidate cached content for public-facing pages:

import { revalidatePath, revalidateTag } from "next/cache";
 
export async function clearCaches() {
  revalidatePath("/", "layout");
  revalidatePath("/blog");
  revalidatePath("/products");
}

Run this after deploying the security patch to ensure no poisoned content remains in the cache.

SSRF

Server Actions and server-side fetch handlers that include user-supplied URLs in requests are potential SSRF vectors. The patch addresses framework-level exposure, but your application code may still be vulnerable if you're building URLs from user input.

Add server-side URL allowlisting for any external requests:

const ALLOWED_HOSTS = new Set(["api.example.com", "cdn.example.com"]);
 
function validateUrl(rawUrl: string): URL {
  const url = new URL(rawUrl); // throws on invalid URLs
  if (!ALLOWED_HOSTS.has(url.hostname)) {
    throw new Error(`Host ${url.hostname} is not allowed`);
  }
  return url;
}
 
export async function fetchExternalData(userUrl: string) {
  const url = validateUrl(userUrl); // validate before use
  const response = await fetch(url.toString());
  return response.json();
}

XSS

Next.js escapes JSX output by default, which covers most rendering paths. The XSS advisories in this release target framework-level vectors that bypass normal escaping under specific conditions.

On the application side, the best defense is sanitizing any user-generated content before rendering it as raw HTML. Use a library like DOMPurify for this:

import DOMPurify from "isomorphic-dompurify";
 
// Sanitize before any raw HTML rendering
const sanitized = DOMPurify.sanitize(userContent);

Patching the framework is necessary but not sufficient — review anywhere in your codebase where raw HTML strings are rendered.

Upgrade Checklist

  1. Run npx next --version to confirm your current version
  2. Update with npm install next@latest
  3. Verify with npm ls next
  4. Run your test suite in staging
  5. Revalidate ISR/cache content after deploying
  6. Review any Middleware auth logic for correctness
  7. Audit raw HTML rendering in your codebase

If you're on Vercel's hosted platform, temporary WAF mitigations may already be applied, but this does not replace patching.

Next.js 15.5 Feature Updates

The security release is part of Next.js 15.5, which also includes:

  • Turbopack Builds (beta): next build --turbopack now supported for production builds
  • Stable Node.js Middleware: Full Node.js runtime in Middleware is now stable, opening up use cases that previously required Edge-incompatible packages
  • TypeScript typed routes: Type-safe href in next/link and navigation methods catch broken links at compile time

Review the 15.5 changelog for any breaking changes before upgrading a large application. For most projects, the upgrade is straightforward — the security gains make it worth prioritizing this week.

← Back to Blog