Certain React Server Components packages used by Next.js versions 13.x, 14.x, 15.x prior to 15.5.16, and 16.x prior to 16.2.5 with the App Router are vulnerable to a denial of service (DoS) attack. An attacker can send a specially crafted HTTP request to an App Router Server Function endpoint that triggers excessive CPU usage during deserialization, causing service disruption. This vulnerability is tracked as CVE-2026-23870 and has a high severity rating with a CVSS score of 7.5. Fixed versions 15.5.16 and 16.2.5 are available to mitigate the issue.