CVE-2026-44579 Details
Description
Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.
A denial-of-service vulnerability has been identified in Next.js versions 15.0.0 prior to 15.5.16 and 16.0.0 prior to 16.2.5. This issue affects applications using Partial Prerendering with the Cache Components feature, where crafted POST requests to a server action can cause connection exhaustion. The malicious requests trigger a deadlock in handling the request body, leaving connections open for a prolonged period. This behavior consumes file descriptors and server resources, ultimately denying service to legitimate users.
Users can upgrade to Next.js versions 15.5.16 or 16.2.5 to address this vulnerability. If an immediate upgrade is not possible, requests containing the 'Next-Resume' header can be blocked at the edge, as these requests would be handled by Next.js.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:34608 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:37272 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:40974 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:54435 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-44579 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477193 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44579.json | redhat-SADP | |
| https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
| CWE-833 | Deadlock | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| vercel next.js | >= 15.0.0, < 15.5.16 >= 16.0.0, < 16.2.5 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 13, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 10, 2026 | CVE Modified | redhat-SADP |
| Jul 3, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |