CVE-2026-44579: Next.js: Denial of Service via connection exhaustion in applications using Cache Components
Impact
Applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service.
Fix
We now treat the header used for resuming Partial Prerendered requests as an internal-only header and strip it from untrusted incoming requests. This header should never be accepted directly from external clients.
Workarounds
If you cannot upgrade immediately, block requests that would be handled by Next.js if they contain the Next-Resume header at the edge.
Other sources
Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.2.5 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.16 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 15.5.16 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 16.2.5 - Configuration
Configure/ensure Next.js does not accept the `Next-Resume` header directly from external clients: treat it as an internal-only header and strip it from untrusted incoming requests (fixed behavior described for the versions that include 15.5.16 and 16.2.5).
Next.js Next-Resume header handling = strip from untrusted incoming requests; treat as internal-only - Compensating control
If you cannot upgrade immediately, block requests that would be handled by Next.js at the edge when they contain the `Next-Resume` header from external clients.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44579?
CVE-2026-44579 is classified as a Denial of Service vulnerability affecting Next.js applications using Cache Components.
How do I fix CVE-2026-44579?
To mitigate CVE-2026-44579, upgrade your Next.js version to 16.2.5 or 15.5.16 as appropriate.
What should I do if I am using an affected version of Next.js related to CVE-2026-44579?
If using an affected version, you should immediately upgrade to a fixed version to prevent connection exhaustion.
Can CVE-2026-44579 affect my application performance?
Yes, CVE-2026-44579 can lead to connection exhaustion, severely impacting your application's performance and availability.
Is there any mitigation if I cannot upgrade for CVE-2026-44579?
If an upgrade is not possible, consider implementing rate limiting or security measures to manage POST request limits.