CVE-2026-44579: Vercel Next.js connection exhaustion in Cache Components

CVE-2026-44579 · Severity: high · CVSS 7.5 · Published 2026-05-13

Next.js is a popular web development framework used to build high-performance websites and applications. A vulnerability in its 'Partial Prerendering' feature allows attackers to crash or slow down a website by sending specially crafted web requests. This can lead to a denial of service, where legitimate customers are unable to access the site, potentially impacting business operations and reputation.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is CVE-2026-44579 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44579 being exploited in the wild.
How severe is CVE-2026-44579?
High severity, with a CVSS score of 7.5, published 13 May 2026.
Which products and versions are affected?
next (npm) SEMVER:introduced=15.0.0,fixed=15.5.16; Vercel Next.js >= 15.0.0, < 15.5.16; >= 16.0.0, < 16.2.5, >=15.0.0, < 15.5.16; >=16.0.0, < 16.2.5.
Is there a fix for CVE-2026-44579?
Yes. next (npm): upgrade to 15.5.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44579 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44579?
Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • next (npm): upgrade to 15.5.16 or later
    npm install next@15.5.16

Technical details

A denial of service vulnerability exists in Next.js versions 15.x and 16.x when Partial Prerendering (PPR) and Cache Components are enabled. The flaw is rooted in how the server handles the 'Next-Resume' header, which is intended for internal use during request resumption. An unauthenticated remote attacker can send a crafted POST request to a server action that triggers a request-body handling deadlock. This deadlock exhausts server resources by leaving connections open and consuming file descriptors until the service becomes unresponsive. The issue is resolved in versions 15.5.16 and 16.2.5 by treating the resumption header as internal-only and stripping it from incoming client requests.

Affected products

  • Vercel Next.js >= 15.0.0, < 15.5.16; >= 16.0.0, < 16.2.5

Identifiers

  • CVE-2026-44579
  • GHSA-mg66-mrh9-m8jx

Timeline

  • 2026-05-06: advisory: GitHub advisory published by Vercel
  • 2026-05-13: disclosed: CVE-2026-44579 published
  • 2026-05-13: patched: Fixes released in versions 15.5.16 and 16.2.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.