{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/next--15.5.16/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["next (\u003c 15.5.16)","next (\u003c 16.2.5)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","connection-exhaustion","next.js","cve-2026-44579"],"_cs_type":"advisory","_cs_vendors":["npm"],"content_html":"\u003cp\u003eA denial-of-service vulnerability (CVE-2026-44579) exists in Next.js applications that utilize Partial Prerendering through the Cache Components feature. This flaw allows an attacker to exhaust server connections by sending specially crafted POST requests to a server action. The malicious requests trigger a deadlock in request-body handling, causing connections to remain open for an extended period. This leads to the consumption of file descriptors and server capacity, ultimately denying service to legitimate users. The vulnerability affects Next.js versions 15.0.0 up to 15.5.16 and 16.0.0 up to 16.2.5. The fix implemented involves treating the \u003ccode\u003eNext-Resume\u003c/code\u003e header as internal-only and stripping it from untrusted incoming requests to prevent external manipulation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a Next.js application using Partial Prerendering and Cache Components.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious POST request targeted at a server action endpoint.\u003c/li\u003e\n\u003cli\u003eThe malicious POST request includes a \u003ccode\u003eNext-Resume\u003c/code\u003e header, intended to exploit the partial prerendering mechanism.\u003c/li\u003e\n\u003cli\u003eThe Next.js application, upon receiving the crafted request, enters a deadlock state while processing the request body.\u003c/li\u003e\n\u003cli\u003eThe connection remains open and consumes server resources, including file descriptors.\u003c/li\u003e\n\u003cli\u003eThe attacker sends multiple such malicious POST requests concurrently, amplifying the resource consumption.\u003c/li\u003e\n\u003cli\u003eThe server\u0026rsquo;s capacity to handle new connections diminishes due to the exhausted resources.\u003c/li\u003e\n\u003cli\u003eLegitimate users are denied service as the server is unable to accept new connections or process their requests, resulting in a denial-of-service condition.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-44579 leads to a denial-of-service condition, rendering Next.js applications unavailable to legitimate users. The number of victims is directly proportional to the attacker\u0026rsquo;s ability to send concurrent malicious requests and the server\u0026rsquo;s capacity to handle connections. Sectors reliant on Next.js applications for critical services, such as e-commerce, content delivery, and web applications, are particularly vulnerable. The vulnerability can severely impact business operations, causing financial losses, reputational damage, and disruption of services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Next.js to version 15.5.16 or later for the 15.x branch, or version 16.2.5 or later for the 16.x branch, to incorporate the fix for CVE-2026-44579.\u003c/li\u003e\n\u003cli\u003eAs a temporary workaround, block incoming requests containing the \u003ccode\u003eNext-Resume\u003c/code\u003e header at the edge to prevent exploitation until the upgrade can be performed (see Overview).\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Suspicious Next-Resume Header\u003c/code\u003e to identify potential exploitation attempts by monitoring for the presence of the \u003ccode\u003eNext-Resume\u003c/code\u003e header in incoming HTTP requests.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for a high volume of POST requests to server action endpoints, which could indicate an attempted denial-of-service attack, and correlate with the \u003ccode\u003eNext-Resume\u003c/code\u003e header to refine detection.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-11T15:59:02Z","date_published":"2026-05-11T15:59:02Z","id":"https://feed.craftedsignal.io/briefs/2026-05-nextjs-dos/","summary":"Next.js applications using Partial Prerendering through Cache Components are vulnerable to connection exhaustion (CVE-2026-44579), where crafted POST requests to a server action trigger a request-body handling deadlock, consuming server capacity and leading to denial of service.","title":"Next.js Cache Components Vulnerable to Denial-of-Service via Connection Exhaustion (CVE-2026-44579)","url":"https://feed.craftedsignal.io/briefs/2026-05-nextjs-dos/"}],"language":"en","title":"CraftedSignal Threat Feed — Next (\u003c 15.5.16)","version":"https://jsonfeed.org/version/1.1"}