PT-2026-39411 · Vercel · Next.Js

Tim Neutkens · Published 2026-05-09 · Updated 2026-05-13 · CVE-2026-44579

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 15.5.16 Next.js versions prior to 16.2.5

Description Applications utilizing Partial Prerendering via the Cache Components feature are susceptible to connection exhaustion. A crafted POST request to a server action can trigger a request-body handling deadlock. This state keeps connections open for an extended period, consuming file descriptors and server capacity, which may result in a denial of service for legitimate users.

Recommendations Update to version 15.5.16. Update to version 16.2.5. As a temporary workaround, block requests at the edge that contain the Next-Resume header.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-44579

GHSA-MG66-MRH9-M8JX

Affected Products

Next.Js

References · 11

• https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44579 · Security Note
• https://osv.dev/vulnerability/GHSA-mg66-mrh9-m8jx · Vendor Advisory
• https://github.com/vercel/next.js/releases/tag/v15.5.16 · Note
• https://github.com/vercel/next.js/releases/tag/v16.2.5 · Note
• https://github.com/vercel/next.js · Note
• https://reddit.com/r/CVEWatch/comments/1tbv4l3/top_10_trending_cves_13052026 · Reddit Post
• https://twitter.com/HackingTeam77/status/2053157851128807882 · Twitter Post
• https://twitter.com/UpwindMDR/status/2053879564124778970 · Twitter Post
• https://t.me/brutsecurity/2701 · Telegram Post
• https://t.me/proxy_bar/3371 · Telegram Post