Guidance on CVE-2026-23864 mitigation for Next.js v14

[rg-medline]

Summary

A recent security scan surfaced CVE-2026-23864, which affects applications using Next.js v14 with the App Router due to its reliance on vulnerable React Server Components behavior. This creates a difficult situation for teams that are otherwise stable on v14 but cannot immediately migrate to newer Next.js or React versions.

Any suggestions on how to move forward.
Thanks in advance

Additional information

CVE-2026-23864 can lead to denial-of-service scenarios via crafted requests targeting App Router server functions.

The vulnerability is inherited from upstream React Server Components behavior.

Example

No response

[icyJoseph]

AFAIK, right now, migrating to v15 is the way. v14 is end-of-life, that's why a patch was not shipped.