PT-2026-25969 · Vercel · Next.Js

Ztanner · Published 2026-03-17 · Updated 2026-03-19 · CVE-2026-27979

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Next.js versions 16.0.1 through 16.1.6

Description Next.js, a React framework for building full-stack web applications, is affected by an issue where requests containing the next-resume: 1 header can lead to excessive memory usage and potential denial of service. This occurs in applications utilizing the App Router with Partial Prerendering enabled (via experimental.ppr or cacheComponents). Specifically, the framework would buffer request bodies without consistently enforcing the maxPostponedStateSize limit in certain configurations. Previous mitigations only addressed minimal-mode deployments, leaving non-minimal deployments vulnerable to unbounded postponed resume-body buffering. The issue arises when an attacker sends oversized next-resume POST payloads, which are then buffered without proper size enforcement, potentially exhausting server memory. The API endpoint receiving these requests is not explicitly specified, but the vulnerability is triggered by the presence of the next-resume header in a POST request. The vulnerable parameter is the request body associated with the next-resume: 1 header.

Recommendations Next.js versions 16.0.1 through 16.1.6 are vulnerable. Upgrade to version 16.1.7 or later to enforce size limits across all postponed-body buffering paths and prevent the issue. If upgrading is not immediately possible, block requests containing the next-resume header, as it should not be sent from untrusted clients.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2026-04706

CVE-2026-27979

GHSA-H27X-G6W4-24GQ

Affected Products

Next.Js

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27979.json · Exploit
• https://github.com/vercel/next.js/security/advisories/GHSA-h27x-g6w4-24gq · Vendor Advisory
• https://github.com/vercel/next.js/commit/c885d4825f800dd1e49ead37274dcd08cdd6f3f1 · Patch
• https://osv.dev/vulnerability/GHSA-h27x-g6w4-24gq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27979 · Security Note
• https://bdu.fstec.ru/vul/2026-04706 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27979 · Vendor Advisory
• https://github.com/vercel/next.js · Note
• https://github.com/vercel/next.js/releases/tag/v16.1.7 · Note
• https://twitter.com/RedPacketSec/status/2034433161896058975 · Twitter Post
• https://twitter.com/CVEarity/status/2034544348063568106 · Twitter Post
• https://twitter.com/VolerionSec/status/2034077842451894455 · Twitter Post
• https://twitter.com/CVEnew/status/2034136445544235262 · Twitter Post