Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Next.js App Router Vulnerable to Malicious Server Crash

published 10 months ago
Summary

Some versions of Next.js App Router can be crashed by a malicious request, causing the server to run out of resources and become unavailable. This affects Next.js versions 15.x and 16.x. Update to the latest version to fix the issue.

What to do
  • Update vercel-release-bot next to version 14.2.34.
  • Update vercel-release-bot next to version 15.0.6.
  • Update vercel-release-bot next to version 15.1.10.
  • Update vercel-release-bot next to version 15.2.7.
  • Update vercel-release-bot next to version 15.3.7.
  • Update vercel-release-bot next to version 15.4.9.
  • Update vercel-release-bot next to version 15.5.8.
  • Update vercel-release-bot next to version 15.6.0-canary.59.
  • Update vercel-release-bot next to version 16.0.9.
  • Update vercel-release-bot next to version 16.1.0-canary.17.
Affected software
Ecosystem VendorProductAffected versions
npm vercel-release-bot next >= 13.3.0, < 14.2.34
>= 15.0.0-canary.0, < 15.0.6
>= 15.1.1-canary.0, < 15.1.10
>= 15.2.0-canary.0, < 15.2.7
>= 15.3.0-canary.0, < 15.3.7
>= 15.4.0-canary.0, < 15.4.9
>= 15.5.1-canary.0, < 15.5.8
>= 15.6.0-canary.0, < 15.6.0-canary.59
>= 16.0.0-beta.0, < 16.0.9
>= 16.1.0-canary.0, < 16.1.0-canary.17
Fix: upgrade to 14.2.34
Original advisory text
Next Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).

A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Type
CWE-400Uncontrolled Resource Consumption
CWE-502Deserialization of Untrusted Data
CWE-1395Dependency on Vulnerable Third-Party Component
Timeline
Published11 Dec 2025
Updated13 Mar 2026
First seen6 Mar 2026
Sources
GHSA-mwv6-3258-q52c · GHSA
Track software like this
Free during beta