Executive brief
Next.js is a popular React framework used to build web applications. The Server Actions feature allows developers to define server-side functions callable from client code. An attacker can craft requests that cause Server Actions to hang indefinitely, consuming server resources and leaving connections open until the hosting provider forcibly terminates the function execution, causing denial of service to legitimate users.
Technical details
This vulnerability is a Denial of Service (DoS) caused by improper handling of long-running or incomplete HTTP requests to Server Actions (CWE-770: Allocation of Resources Without Limits or Throttling). An attacker can construct requests that leave Server Actions hanging until the hosting provider cancels function execution. The vulnerability affects Next.js versions 13.0.0–13.5.7, 14.0.0–14.2.20, and 15.0.0–15.1.1. No authentication or user interaction is required; the attack is remotely exploitable over the network. While the Next.js server remains idle with low CPU and memory usage, the hanging connections prevent legitimate requests from being processed. The issue was patched in versions 13.5.8, 14.2.21, and 15.1.2.
Affected products
- Vercel Next.js 13.0.0 to 13.5.7, 14.0.0 to 14.2.20, 15.0.0 to 15.1.1
Timeline
- 2025-01-03: disclosed
- 2025-01-03: patched: Fixed in Next.js 13.5.8, 14.2.21, and 15.1.2