Packages / next / Security

ModerateVulnerabilityGHSA-7m27-7ghc-44w9CVE-2024-56332Published 3 Jan 2025

Next.js Allows a Denial of Service (DoS) with Server Actions

Affected releases · next

  • 15.x15.0.0 – 15.1.1Fixed in 15.1.2
  • 14.x14.0.0 – 14.2.20Fixed in 14.2.21
  • 13.x13.0.0 – 13.5.7Fixed in 13.5.8

On 15.x, the newest line:

npm install next@15.1.2
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

15.x

  1. Affected

    15.0.0 – 15.1.1

    11 releases

  2. Fixed

    15.1.2 – 15.5.28

    71 releases

14.x

  1. Affected

    14.0.0 – 14.2.20

    31 releases

  2. Fixed

    14.2.21 – 14.2.35

    15 releases

13.x

  1. Affected

    13.0.0 – 13.5.7

    52 releases

  2. Fixed

    13.5.8 – 13.5.11

    4 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

A Denial of Service (DoS) attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution.

Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.

Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing.

This is the same issue as if the incoming HTTP request has an invalid Content-Length header or never closes. If the host has no other mitigations to those then this vulnerability is novel.

This vulnerability affects only Next.js deployments using Server Actions.

Patches

This vulnerability was resolved in Next.js 14.2.21, 15.1.2, and 13.5.8. We recommend that users upgrade to a safe version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

Thanks to the PackDraw team for responsibly disclosing this vulnerability.