Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-05-13T17:04:28 next.js: Next.js: Denial of Service via crafted POST requests to server actions 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-833

Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.

A flaw was found in Next.js. Applications utilizing Partial Prerendering via the Cache Components feature are susceptible to connection exhaustion. A remote attacker can send crafted POST requests to a server action, triggering a request-body handling deadlock. This leaves connections open, consuming server resources and ultimately leading to a Denial of Service (DoS) for legitimate users.

This vulnerability is rated as Important as Next.js applications configured with Partial Prerendering and Cache Components are susceptible to a remote denial of service. An unauthenticated attacker can exhaust server connections by sending specially crafted POST requests, leading to a complete disruption of service for legitimate users. This impact is significant due to the potential for widespread unavailability of affected web applications. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Streams for Apache Kafka 2.9.4 2026-07-02T00:00:00Z RHSA-2026:34608 next Red Hat Trusted Artifact Signer 1.3 2026-07-16T00:00:00Z RHSA-2026:40974 rhtas/rekor-search-ui-rhel9:1783958622 Red Hat Trusted Artifact Signer 1.4 2026-07-09T00:00:00Z RHSA-2026:37272 rhtas/rekor-search-ui-rhel9:1783327185 Red Hat Enterprise Linux 10 Not affected firefox Red Hat Enterprise Linux 10 Not affected thunderbird Red Hat Enterprise Linux 7 Not affected firefox Red Hat Enterprise Linux 8 Not affected firefox Red Hat Enterprise Linux 8 Not affected thunderbird Red Hat Enterprise Linux 9 Not affected firefox Red Hat Enterprise Linux 9 Not affected thunderbird Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/disk-image-cuda-rhel9 streams for Apache Kafka 3 Affected next https://www.cve.org/CVERecord?id=CVE-2026-44579 https://nvd.nist.gov/vuln/detail/CVE-2026-44579 https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx