The Deploy Log | Tools and products | Free, no signup

CVE-2026-23869

Vercel | In Edition 29, Saturday 11 Apr 2026

The call on this one

DEPLOYif you run Next.js App Router

SOURCE Vercel, Summary of CVE-2026-23869

A high-severity React Server Components vulnerability with CVSS 7.5 can cause denial of service, and Vercel deployed WAF rules to protect all hosted projects while requiring upgrades to patched versions 15.5.15 and 16.2.3.

Added to The Deploy Log Tuesday 15 Sep 2026, updated Thursday 17 Sep 2026. Read Edition 29, the edition that carried it.

121 rows from Vercel in The Deploy Log are dated on or before this one, this one included.

The same day from Vercel: Opus 4.6 Fast Mode (0 days apart). After it: Vercel Flags GA, 5 days later.

Week of April 6, 2026 | April 2026

One line every time AI actually ships, as it ships, 24/7. Follow the wire: Threads | Bluesky

One line every time AI actually ships, around the clock, free on Threads and Bluesky. Every one is in The Deploy Log with its source.

Follow on Threads Follow on Bluesky

The Saturday edition is the week in one, free to read on the site, and by email if you want it: get it by email.