Vulnerability GHSA-p3m5-59mp-jv5r

High Risk

12 days ago

Next.js: Denial of Service in App Router using Server Actions

13.0.0 - 15.5.27 and 16.0.0 - 16.4.0

Summary

Next.js: Denial of Service in App Router using Server Actions

Details

Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Critical

12 days ago

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

16.0.0 - 16.4.0 GHSA-673q-mjm6-r5xr

Medium Risk

12 days ago

next.js cache leak across root param values in nested 'use cache' functions

16.3.0 - 16.3.7 GHSA-h694-7cp9-m8p3

Critical

12 days ago

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

10.0.0 - 15.5.27 and 16.0.0 - 16.4.0 GHSA-2464-fhr4-w9xw

Medium Risk

27 days ago

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

16.3.0 - 16.3.7 GHSA-3w37-wq28-93x7

Medium Risk

27 days ago

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

15.0.0 - 15.5.26 and 16.0.0 - 16.3.7 GHSA-4jqv-mc3x-m676

View all vulnerabilities for these packages

Impacted packages

Timeline

Published

12 days ago

Fixed (15.5.28)

20 days ago

Fixed (16.4.1)

Unknown

Last Modified

12 days ago