Clarification on CVE-2026-23864

[jdevcc]

Summary

We are using Next.js 14.2.35.

This GitHub advisory lists Next.js >= 13.0.0, < 15.0.8 as affected.

However, upstream sources (such as Facebook's advisory) indicate the vulnerability is isolated to react-server-dom-parcel, react-server-dom-webpack, and react-server-dom-turbopack.

We ran npm list and confirmed that none of these specific packages are present in our dependency tree. Is Next.js itself vulnerable?

Additional information

No response

Example

No response

[icyJoseph]

Hi, Next.js in App Router apps managed the React version internally. If you use App Router on 14.2.35, you should migrate to version 15.

• https://nextjs.org/docs#app-router-and-pages-router
• https://nextjs.org/docs/app/guides/upgrading/version-15

Please do comment back if there's some blocker on migrating to v15.

As per why this is the case, the answer is that v14 is End-of-life, https://nextjs.org/support-policy#supported-versions -