Описание
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.
Ссылки
- Patch
- Patch
- ProductRelease Notes
- ProductRelease Notes
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 13.0.0 (включая) до 15.5.21 (исключая)Версия от 16.0.0 (включая) до 16.2.11 (исключая)
Одно из
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 42%
0.00531
Низкий
5.3 Medium
CVSS3
Дефекты
CWE-770
Связанные уязвимости
CVSS3: 7.5
redhat
5 дней назад
A flaw was found in Next.js. An attacker sending specially crafted requests to a Next.js application utilizing the App Router with Server Actions configured to use the Edge runtime can cause excessive memory consumption. This can lead to a denial of service (DoS) due to resource exhaustion.
EPSS
Процентиль: 42%
0.00531
Низкий
5.3 Medium
CVSS3
Дефекты
CWE-770