CVE-2026-44579— Next.js 安全漏洞

Next.js: Denial of Service via connection exhaustion in applications using Cache Components

Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

不加限制或调节的资源分配

Next.js 安全漏洞

Next.js是Vercel开源的一个 React 框架。 Next.js 15.5.16之前版本和16.2.5之前版本存在安全漏洞，该漏洞源于使用Partial Prerendering的Cache Components功能时，特制POST请求到服务器操作可能导致连接耗尽，造成拒绝服务。

N/A

N/A