Next.js May 2026 security release

In three linesVercel releases coordinated security patch for Next.js addressing 13 vulnerabilities: auth bypass via App Router, dynamic route parameter injection, cache poisoning, DoS in React Server Components (CVE-2026-23870), and XSS. Immediate upgrade mandatory for all affected users.

Summary generated by Claude — human-verified