CVE-2024-39693: Next.js Denial of Service (DoS) condition
Impact A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server.
This vulnerability can affect all Next.js deployments on the affected versions.
Patches This vulnerability was resolved in Next.js 13.5 and later. We recommend that users upgrade to a safe version.
Workarounds There are no official workarounds for this vulnerability.
Credit Thai Vu of flyseccorp.com Aonan Guan (@0dd), Senior Cloud Security Engineer
Other sources
Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. his vulnerability was resolved in Next.js 13.5 and later.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39693?
CVE-2024-39693 has been classified as a Denial of Service (DoS) vulnerability.
How do I fix CVE-2024-39693?
To resolve CVE-2024-39693, upgrade your Next.js version to 13.5.0 or later.
Which versions of Next.js are affected by CVE-2024-39693?
CVE-2024-39693 affects Next.js versions from 13.3.1 up to but not including 13.5.0.
What are the consequences of exploiting CVE-2024-39693?
Exploiting CVE-2024-39693 can lead to a crash of the server, resulting in service unavailability.
Is my Next.js deployment at risk with CVE-2024-39693?
Yes, if you are using an affected version of Next.js, your deployment is at risk for CVE-2024-39693.