Packages / next / Security

HighVulnerabilityGHSA-fq54-2j52-jc42CVE-2024-39693Published 10 Jul 2024

Next.js Denial of Service (DoS) condition

Affected releases · next

  • 13.x13.3.1 – 13.4.19Fixed in 13.5.0

On 13.x, the newest line:

npm install next@13.5.0
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

13.x

  1. Not affected

    13.0.0 – 13.3.0

    21 releases

  2. Affected

    13.3.1 – 13.4.19

    23 releases

  3. Fixed

    13.5.0 – 13.5.11

    12 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server.

This vulnerability can affect all Next.js deployments on the affected versions.

Patches

This vulnerability was resolved in Next.js 13.5 and later. We recommend that users upgrade to a safe version.

Workarounds

There are no official workarounds for this vulnerability.

Credit