CVE-2026-44579: CWE-770: Allocation of Resources Without Limits or Throttling in vercel next.js
Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.
AI Analysis
Technical Summary
CVE-2026-44579 describes a resource exhaustion vulnerability in Next.js affecting applications that utilize Partial Prerendering via the Cache Components feature. An unauthenticated remote attacker can send specially crafted POST requests to server actions, triggering a deadlock in request-body handling. This deadlock causes connections to remain open for extended periods, consuming file descriptors and server capacity, ultimately leading to denial of service for legitimate users. The vulnerability is addressed in Next.js versions 15.5.16 and 16.2.5. The issue is tracked under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-833 (Deadlock).
Potential Impact
The vulnerability allows an unauthenticated attacker to exhaust server connections by causing request handling deadlocks, leading to denial of service for legitimate users. This can result in widespread unavailability of affected Next.js web applications configured with Partial Prerendering and Cache Components. The CVSS v3.1 score is 7.5 (High), reflecting a network attack vector with low complexity, no privileges required, no user interaction, and high availability impact.
Mitigation Recommendations
A fix is available in Next.js versions 15.5.16 and 16.2.5. Users should upgrade to these or later versions to remediate the vulnerability. According to the Red Hat advisory, no effective mitigation other than upgrading is currently available or meets their criteria for ease of use and applicability. Therefore, upgrading is the recommended remediation.
CVE-2026-44579: CWE-770: Allocation of Resources Without Limits or Throttling in vercel next.js
Description
Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.
CVSS v3.1
Score 7.5high
Affected software
vercel
next.js
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-44579 describes a resource exhaustion vulnerability in Next.js affecting applications that utilize Partial Prerendering via the Cache Components feature. An unauthenticated remote attacker can send specially crafted POST requests to server actions, triggering a deadlock in request-body handling. This deadlock causes connections to remain open for extended periods, consuming file descriptors and server capacity, ultimately leading to denial of service for legitimate users. The vulnerability is addressed in Next.js versions 15.5.16 and 16.2.5. The issue is tracked under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-833 (Deadlock).
Potential Impact
The vulnerability allows an unauthenticated attacker to exhaust server connections by causing request handling deadlocks, leading to denial of service for legitimate users. This can result in widespread unavailability of affected Next.js web applications configured with Partial Prerendering and Cache Components. The CVSS v3.1 score is 7.5 (High), reflecting a network attack vector with low complexity, no privileges required, no user interaction, and high availability impact.
Mitigation Recommendations
A fix is available in Next.js versions 15.5.16 and 16.2.5. Users should upgrade to these or later versions to remediate the vulnerability. According to the Red Hat advisory, no effective mitigation other than upgrading is currently available or meets their criteria for ease of use and applicability. Therefore, upgrading is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-06T21:49:12.424Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-44579","vendor":"Red Hat"}]
Threat ID: 6a04ba22cbff5d8610f482d8
Added to database: 05/13/2026, 17:51:30 UTC
Last enriched: 08/13/2026, 13:04:17 UTC
Last updated: 09/14/2026, 10:01:31 UTC
Views: 106
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.