How do I check whether I am affected by GHSA-vfv6-92ff-j949?

- Run `npm ls next react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack` in the application to see the installed versions - Check the Next.js version in `package.json` and the lockfile against the patched versions listed in the fix - unknown whether a specific check exists for GHSA-vfv6-92ff-j949 beyond version comparison

What is the fix for GHSA-vfv6-92ff-j949?

- Next.js: move to `15.5.16` or `16.2.5` - React `react-server-dom-webpack`, `react-server-dom-parcel` and `react-server-dom-turbopack`: move to `19.0.6`, `19.1.7` or `19.2.6` matching the major line - Do not rely on WAF rules alone; update the application and its dependencies

Who is not affected by GHSA-vfv6-92ff-j949?

Not affected if: static-export.

Live › vulnerability › GHSA-vfv6-92ff-j949

Go to dashboard

unknownPackage

WAF and framework adapter mitigations for React and Next.js vulnerabilities · Changelog

This is a Cloudflare changelog entry covering a batch of disclosed React Server Components and Next.js flaws, including denial of service, middleware bypass, SSRF, XSS and cache poisoning. The specific advisory GHSA-vfv6-92ff-j949 is a low-severity cache poisoning issue via RSC cache-busting collisions, and Cloudflare says no managed WAF rule can safely block it.

Summary written from the sources below. Check the originals before acting.

Known so far

4/6

unknown

no CVSS yet; severity from the sources

known so far4 of 6

missing: versions, exploitation

First public: May 7, 2026 UTC
Last modified: Oct 25, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-24 18:56 UTC. All times on this page are UTC.

Why it is unknown, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Cache poisoning serves wrong RSC responses to other users.
CVSS said: No score. The facts above say medium; we keep the sources' unknown until an analyst looks.

Who is affected

Applications that use React Server Components or Next.js with the affected React server-dom packages or Next.js versions are exposed. Sites on Vinext or on static export without RSC are not covered by the same code paths, but the sources do not say which configurations are safe for this specific advisory. Teams behind Cloudflare managed rules still need to patch, since WAF coverage for this flaw is not available.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › GHSA-vfv6-92ff-j949

Go to dashboard

unknownPackage

WAF and framework adapter mitigations for React and Next.js vulnerabilities · Changelog

Summary written from the sources below. Check the originals before acting.

Known so far

4/6

unknown

no CVSS yet; severity from the sources

known so far4 of 6

missing: versions, exploitation

First public: May 7, 2026 UTC
Last modified: Oct 25, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-24 18:56 UTC. All times on this page are UTC.

Why it is unknown, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Cache poisoning serves wrong RSC responses to other users.
CVSS said: No score. The facts above say medium; we keep the sources' unknown until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack