Preliminary research

CVE-2026-23870: A Single POST Freezes Any Next.js Server

Simon Koeck · Simon Koeck · 8 October 2026

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Each nested FormData reference rescans the entire request synchronously; attacker-controlled reference count and field count multiply, blocking the event loop.

Record

Researcher

Simon Koeck

Published by

Simon Koeck

Date

8 October 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• May advisory

Tags

• react
• algorithmic-complexity
• dos
• deserialization
• owasp-a04-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Simon Koeck, first published at the original source. Preserved copies are kept so the citation survives its host.