Описание
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.
A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usage, causing the application to become unresponsive and preventing it from processing further requests, resulting in a Denial of Service (DoS).
Отчет
Important: A denial of service flaw exists in Next.js applications utilizing the App Router with Server Actions. Crafted requests can lead to excessive CPU consumption, potentially disrupting service availability for affected Red Hat products that embed or depend on vulnerable Next.js versions.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | i18next | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/backend-rhel8 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel7 | Not affected | ||
| Red Hat AMQ Broker 7 | i18next | Not affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | quarkus-websockets-next-spi | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | i18next | Not affected | ||
| Red Hat build of Apache Camel - HawtIO 4 | quarkus-websockets-next-spi | Not affected | ||
| Red Hat build of Apicurio Registry 3 | quarkus-websockets-next-spi | Not affected | ||
| Red Hat Build of Keycloak | quarkus-websockets-next-spi | Affected | ||
| Red Hat build of Quarkus | quarkus-websockets-next-deployment | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.
Next.js: Denial of Service in App Router using Server Actions
EPSS
7.5 High
CVSS3