GHSA-p3m5-59mp-jv5r: Npm/next vulnerability
Impact
Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.
Workarounds
No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.28
Event History
Frequently Asked Questions
Which Next.js applications are affected?
Applications using the App Router that have at least one Server Action are affected. Applications using the Pages Router, or applications that do not use Server Actions, are not vulnerable.
What does an attacker need to do to trigger the issue?
An attacker needs to send crafted requests targeting an affected Next.js application. Successful exploitation can cause excessive CPU use and block further request processing in the same process.
Is there a mitigation if upgrading cannot happen immediately?
No workaround is available other than upgrading.