Next.js: Denial of Service in App Router using Server Actions
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 15.5.28, 16.4.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Next.js, a React framework for building web applications, is affected when its App Router is used with at least one Server Action. Specially crafted requests can cause excessive CPU usage that blocks the server from handling further requests, resulting in a denial of service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- vercel next.js
From 13.0.0 · fixed in 15.5.28; From 16.0.0 · fixed in 16.4.1
- nextnpm
From 13.0.0 · fixed in 15.5.28
- nextnpm
From 16.0.0 · fixed in 16.4.1