Next.js & React CVEs: What Vibe Coders Must Patch
Two Next.js DoS bugs and a high-severity React Server Components flaw landed this week. Here's what vibe coders on Next.js need to check and patch now.
Two denial-of-service bugs and one high-severity React bug landed in the Next.js and React ecosystem this week. If your AI builder generated a Next.js app — and a lot of Lovable, v0, and Bolt output runs on Next.js under the hood — this is worth five minutes of your time.
TL;DR
- CVE-2025-59471 and CVE-2025-59472 are medium-severity (CVSS 5.9) denial-of-service bugs in the Next.js Image Optimizer, affecting self-hosted apps with
remotePatternsconfigured for external images.- CVE-2026-23864 is a high-severity (CVSS 7.5) bug in React Server Components. It does not allow remote code execution, but Vercel says immediate upgrades are required regardless.
- Apps hosted on Vercel's own platform are not affected by the Image Optimizer DoS bugs. The RSC bug is different — Vercel shipped a WAF rule as a stopgap but says not to rely on it alone.
- Separately, r/vibecoding is having a real conversation about scaling AI-written code past what QA can review — which is exactly how bugs like these slip into production.
Two Next.js DoS bugs, and who's actually exposed
CVE-2025-59471 and CVE-2025-59472 both hit the Next.js Image Optimizer when external image optimization is enabled via remotePatterns. Under specific configurations, an attacker can crash the server through memory exhaustion. There's no data exposure and no privilege escalation — this is availability, not confidentiality. If you deployed straight from Lovable, Bolt, or v0 onto Vercel's platform, you're not affected. If you self-host your Next.js app on your own server or a VPS, check whether you use remotePatterns and update.
The React Server Components bug needs an actual patch
CVE-2026-23864 is a different animal. It's high severity (CVSS 7.5) and affects React Server Components directly — meaning any framework built on RSC, including current Next.js versions, inherits the risk. Vercel confirms it does not allow remote code execution, and the company pushed new WAF rules that automatically protect all projects hosted on Vercel at no cost. But Vercel is explicit here: the WAF is a mitigation, not a fix. If your app uses RSC, you still need to upgrade to a patched version. If you don't know whether your builder's output uses RSC, check your package.json for react-server-dom or a recent Next.js App Router setup — that's the tell.
Why vibe-coded teams are the ones most likely to miss this
A thread on r/vibecoding this week described a company running fully AI-generated commits at team scale, with QA finding issues that
Find your gaps before an attacker does.
Is My Site Hackable? scans your deployed app for the exact issues in this article — exposed keys, missing RLS, open buckets — and tells you what's real and what's a false alarm.
Run a free scan →