CVE-2026-44579 affects Next.js, a React framework, in versions before 15.5.16 and 16.2.5 when using Partial Prerendering through the Cache Components feature. A maliciously crafted POST request to a server action can trigger a deadlock in request-body handling, causing connections to remain open for extended periods. This leads to exhaustion of file descriptors and server capacity, resulting in denial of service for legitimate users. The vulnerability is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-833 (Deadlock). The issue has been fixed in Next.js versions 15.5.16 and 16.2.5. No known exploits in the wild have been reported. The vendor advisory from Red Hat confirms the vulnerability and references the fixed versions.

Successful exploitation can cause denial of service by exhausting server resources such as file descriptors and connection capacity. This prevents legitimate users from accessing the affected Next.js application. There is no impact on confidentiality or integrity reported. The vulnerability specifically affects server-side handling of POST requests in certain Next.js configurations.

Upgrade Next.js to version 15.5.16 or 16.2.5 or later, where this vulnerability is fixed. Since this is not a cloud service, users must apply the patch themselves. Patch status is confirmed by the vendor advisory. No alternative mitigations or temporary fixes are indicated in the advisory.