Junglewise Threat Intelligence

Next.js denial of service in Server Components with incomplete fix

Severity: low · CVSS 3.1 · Published 2025-12-12

Technologies: Vercel Next.js. Vendors: Vercel.

Executive brief

Next.js is a popular React framework used to build web applications. A vulnerability in how Next.js handles requests to Server Function endpoints allows an attacker to send a specially crafted HTTP request that causes the server process to enter an infinite loop, consuming CPU and making the application unresponsive to legitimate users. This is a follow-up to an earlier patch that was incomplete and did not fully eliminate the vulnerability.

Technical details

The vulnerability exists in the deserialization of payloads from HTTP requests sent to React Server Components (RSC) Server Function endpoints. The issue was initially addressed in a patch for CVE-2025-55184, but that fix was incomplete and did not prevent all attack vectors. The newly identified CVE-2025-67779 represents a follow-up case where carefully crafted input can still trigger an infinite loop in the RSC runtime during payload processing. When a malicious actor sends such a request to an affected endpoint, the server process enters an infinite loop consuming CPU and becoming unresponsive, resulting in denial of service. The vulnerability requires only network access and no authentication or user interaction. Patched versions have been released for all affected Next.js versions (14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 15.6.0-canary.60, 16.0.10, and 16.1.0-canary.19).

Affected products

  • Vercel Next.js 13.3.x through 14.2.34; 15.0.0 through 15.0.6; 15.1.0 through 15.1.10; 15.2.0 through 15.2.7; 15.3.0 through 15.3.7; 15.4.0 through 15.4.9; 15.5.0 through 15.5.8; 15.6.0-canary.0 through 15.6.0-canary.59; 16.0.0 through 16.0.9; 16.1.0-canary.0 through 16.1.0-canary.18

Timeline

  • 2025-12-11: disclosed: Initial incomplete fix for CVE-2025-55184 disclosed
  • 2025-12-12: disclosed: Incomplete fix identified; CVE-2025-67779 published as complete fix
  • 2025-12-12: patched: Patches released for all affected Next.js versions

References

Related threats