CoreCVE
Back

HIGH

Next.js: Denial of Service via connection exhaustion in applications using Cache Components

Published May 13, 2026

Description

Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.

Affected products

Remediation

Red Hat statement

This vulnerability is rated as Important as Next.js applications configured with Partial Prerendering and Cache Components are susceptible to a remote denial of service. An unauthenticated attacker can exhaust server connections by sending specially crafted POST requests, leading to a complete disruption of service for legitimate users. This impact is significant due to the potential for widespread unavailability of affected web applications.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (2)

CWE-770

Allocation of Resources Without Limits

CWE-833

References (13)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published May 13, 2026
Updated Aug 13, 2026
Reserved May 6, 2026
Link CVE-2026-44579
CISA Vulnrichment
Updated May 14, 2026
NVD
Status Modified
Modified Aug 13, 2026
Link CVE-2026-44579
Red Hat
Severity Important
Public date May 13, 2026
Links CVE-2026-44579 - Bugzilla
GHSA-MG66-MRH9-M8JX