Read the docs
TI-2025-37017 Aliases CVE-2025-59472GHSA-5f7q-jpqc-wp7h

Uncontrolled resource consumption in vercel next

Priority LOW 33CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion: 1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory. 2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion. Both attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server. To be affected you must have an application running with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable. Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00427 37th percentileScored 2026-11-07
Fix Partial next (vercel): 15.0.0, 15.0.1, 15.0.2 +57next (npm): 16.1.5, 15.6.0-canary.61Red Hat: 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vercelnext15.0.0-canary.0 to before 15.0.0; 15.0.1-canary.0 to before 15.0.1; 15.0.2-canary.0 to before 15.0.2; 15.0.3-canary.0 to before 15.0.3; 15.0.4-canary.0 to before 15.0.4; 15.1.0-canary.0 to before 15.1.0; 15.1.1-canary.0 to before 15.1.1; 15.1.2-canary.0 to before 15.1.2; 15.1.3-canary.0 to before 15.1.3; 15.1.4-canary.0 to before 15.1.4; 15.1.5-canary.0 to before 15.1.5; 15.1.6-canary.0 to before 15.1.6; 15.1.7-canary.0 to before 15.1.7; 15.2.0-canary.0 to before 15.2.0; 15.2.1-canary.0 to before 15.2.1; 15.2.2-canary.0 to before 15.2.2; 15.2.3-canary.0 to before 15.2.3; 15.2.4-canary.0 to before 15.2.4; 15.2.5-canary.0 to before 15.2.5; 15.3.0-canary.0 to before 15.3.0; 15.3.1-canary.0 to before 15.3.1; 15.3.2-canary.0 to before 15.3.2; 15.1.8-canary.0 to before 15.1.8; 15.3.3-canary.0 to before 15.3.3; 15.4.0-canary.0 to before 15.4.0; 15.3.4-canary.0 to before 15.3.4; 15.3.5-canary.0 to before 15.3.5; 15.4.1-canary.0 to before 15.4.1; 15.4.2-canary.0 to before 15.4.2; 15.4.3-canary.0 to before 15.4.3; 15.4.4-canary.0 to before 15.4.4; 15.4.5-canary.0 to before 15.4.5; 15.4.6-canary.0 to before 15.4.6; 15.4.7-canary.0 to before 15.4.7; 15.5.0-canary.0 to before 15.5.0; 15.5.1-canary.0 to before 15.5.1; 15.5.2-canary.0 to before 15.5.2; 15.5.3-canary.0 to before 15.5.3; 15.5.4-canary.0 to before 15.5.4; 15.5.5-canary.0 to before 15.5.5; 15.5.6-canary.0 to before 15.5.6; 15.5.7-canary.0 to before 15.5.7; 15.4.8-canary.0 to before 15.4.8; 15.1.9-canary.0 to before 15.1.9; 15.0.5-canary.0 to before 15.0.5; 15.3.6-canary.0 to before 15.3.6; 15.2.6-canary.0 to before 15.2.6; 15.5.8-canary.0 to before 15.5.8; 15.4.9-canary.0 to before 15.4.9; 15.3.7-canary.0 to before 15.3.7; 15.2.7-canary.0 to before 15.2.7; 15.1.10-canary.0 to before 15.1.10; 15.0.6-canary.0 to before 15.0.6; 15.5.9-canary.0 to before 15.5.9; 15.4.10-canary.0 to before 15.4.10; 15.3.8-canary.0 to before 15.3.8; 15.2.8-canary.0 to before 15.2.8; 15.1.11-canary.0 to before 15.1.11; 15.0.7-canary.0 to before 15.0.7; 16.1.0 to before 16.1.515.0.0, 15.0.1, 15.0.2, 15.0.3, 15.0.4, 15.1.0, 15.1.1, 15.1.2, 15.1.3, 15.1.4, 15.1.5, 15.1.6, 15.1.7, 15.2.0, 15.2.1, 15.2.2, 15.2.3, 15.2.4, 15.2.5, 15.3.0, 15.3.1, 15.3.2, 15.1.8, 15.3.3, 15.4.0, 15.3.4, 15.3.5, 15.4.1, 15.4.2, 15.4.3, 15.4.4, 15.4.5, 15.4.6, 15.4.7, 15.5.0, 15.5.1, 15.5.2, 15.5.3, 15.5.4, 15.5.5, 15.5.6, 15.5.7, 15.4.8, 15.1.9, 15.0.5, 15.3.6, 15.2.6, 15.5.8, 15.4.9, 15.3.7, 15.2.7, 15.1.10, 15.0.6, 15.5.9, 15.4.10, 15.3.8, 15.2.8, 15.1.11, 15.0.7, 16.1.5Patch availableCNA
—next (npm)16.0.0-beta.0 to before 16.1.516.1.5Patch availableGHSA-5f7q-jpqc-wp7h
—next (npm)15.0.0-canary.0 – 15.0.0-canary.205—No fix listedGHSA-5f7q-jpqc-wp7h
—next (npm)15.0.1-canary.0 – 15.0.1-canary.3—No fix listedGHSA-5f7q-jpqc-wp7h
—next (npm)15.0.2-canary.0 – 15.0.2-canary.11—No fix listedGHSA-5f7q-jpqc-wp7h
—next (npm)15.0.3-canary.0 – 15.0.3-canary.9—No fix listedGHSA-5f7q-jpqc-wp7h
—next (npm)15.0.4-canary.0 – 15.0.4-canary.52—No fix listedGHSA-5f7q-jpqc-wp7h
—next (npm)15.1.1-canary.0 – 15.1.1-canary.27—No fix listedGHSA-5f7q-jpqc-wp7h
—next (npm)15.2.0-canary.0 – 15.2.0-canary.77—No fix listedGHSA-5f7q-jpqc-wp7h
—next (npm)15.2.1-canary.0 – 15.2.1-canary.6—No fix listedGHSA-5f7q-jpqc-wp7h
—next (npm)15.2.2-canary.0 – 15.2.2-canary.7—No fix listedGHSA-5f7q-jpqc-wp7h
—next (npm)15.3.0-canary.0 – 15.3.0-canary.46—No fix listedGHSA-5f7q-jpqc-wp7h
—next (npm)15.3.1-canary.0 – 15.3.1-canary.15—No fix listedGHSA-5f7q-jpqc-wp7h
—next (npm)15.4.0-canary.0 – 15.4.0-canary.130—No fix listedGHSA-5f7q-jpqc-wp7h
—next (npm)15.4.2-canary.0 – 15.4.2-canary.56—No fix listedGHSA-5f7q-jpqc-wp7h
—next (npm)15.5.1-canary.0 – 15.5.1-canary.39—No fix listedGHSA-5f7q-jpqc-wp7h
—next (npm)15.6.0-canary.0 to before 15.6.0-canary.6115.6.0-canary.61Patch availableGHSA-5f7q-jpqc-wp7h
  • next Vendorvercel Affected 15.0.0-canary.0 to before 15.0.0; 15.0.1-canary.0 to before 15.0.1; 15.0.2-canary.0 to before 15.0.2; 15.0.3-canary.0 to before 15.0.3; 15.0.4-canary.0 to before 15.0.4; 15.1.0-canary.0 to before 15.1.0; 15.1.1-canary.0 to before 15.1.1; 15.1.2-canary.0 to before 15.1.2; 15.1.3-canary.0 to before 15.1.3; 15.1.4-canary.0 to before 15.1.4; 15.1.5-canary.0 to before 15.1.5; 15.1.6-canary.0 to before 15.1.6; 15.1.7-canary.0 to before 15.1.7; 15.2.0-canary.0 to before 15.2.0; 15.2.1-canary.0 to before 15.2.1; 15.2.2-canary.0 to before 15.2.2; 15.2.3-canary.0 to before 15.2.3; 15.2.4-canary.0 to before 15.2.4; 15.2.5-canary.0 to before 15.2.5; 15.3.0-canary.0 to before 15.3.0; 15.3.1-canary.0 to before 15.3.1; 15.3.2-canary.0 to before 15.3.2; 15.1.8-canary.0 to before 15.1.8; 15.3.3-canary.0 to before 15.3.3; 15.4.0-canary.0 to before 15.4.0; 15.3.4-canary.0 to before 15.3.4; 15.3.5-canary.0 to before 15.3.5; 15.4.1-canary.0 to before 15.4.1; 15.4.2-canary.0 to before 15.4.2; 15.4.3-canary.0 to before 15.4.3; 15.4.4-canary.0 to before 15.4.4; 15.4.5-canary.0 to before 15.4.5; 15.4.6-canary.0 to before 15.4.6; 15.4.7-canary.0 to before 15.4.7; 15.5.0-canary.0 to before 15.5.0; 15.5.1-canary.0 to before 15.5.1; 15.5.2-canary.0 to before 15.5.2; 15.5.3-canary.0 to before 15.5.3; 15.5.4-canary.0 to before 15.5.4; 15.5.5-canary.0 to before 15.5.5; 15.5.6-canary.0 to before 15.5.6; 15.5.7-canary.0 to before 15.5.7; 15.4.8-canary.0 to before 15.4.8; 15.1.9-canary.0 to before 15.1.9; 15.0.5-canary.0 to before 15.0.5; 15.3.6-canary.0 to before 15.3.6; 15.2.6-canary.0 to before 15.2.6; 15.5.8-canary.0 to before 15.5.8; 15.4.9-canary.0 to before 15.4.9; 15.3.7-canary.0 to before 15.3.7; 15.2.7-canary.0 to before 15.2.7; 15.1.10-canary.0 to before 15.1.10; 15.0.6-canary.0 to before 15.0.6; 15.5.9-canary.0 to before 15.5.9; 15.4.10-canary.0 to before 15.4.10; 15.3.8-canary.0 to before 15.3.8; 15.2.8-canary.0 to before 15.2.8; 15.1.11-canary.0 to before 15.1.11; 15.0.7-canary.0 to before 15.0.7; 16.1.0 to before 16.1.5 Fixed in 15.0.0, 15.0.1, 15.0.2, 15.0.3, 15.0.4, 15.1.0, 15.1.1, 15.1.2, 15.1.3, 15.1.4, 15.1.5, 15.1.6, 15.1.7, 15.2.0, 15.2.1, 15.2.2, 15.2.3, 15.2.4, 15.2.5, 15.3.0, 15.3.1, 15.3.2, 15.1.8, 15.3.3, 15.4.0, 15.3.4, 15.3.5, 15.4.1, 15.4.2, 15.4.3, 15.4.4, 15.4.5, 15.4.6, 15.4.7, 15.5.0, 15.5.1, 15.5.2, 15.5.3, 15.5.4, 15.5.5, 15.5.6, 15.5.7, 15.4.8, 15.1.9, 15.0.5, 15.3.6, 15.2.6, 15.5.8, 15.4.9, 15.3.7, 15.2.7, 15.1.10, 15.0.6, 15.5.9, 15.4.10, 15.3.8, 15.2.8, 15.1.11, 15.0.7, 16.1.5 Patch available CNA
  • next (npm) Vendor— Affected 16.0.0-beta.0 to before 16.1.5 Fixed in 16.1.5 Patch available GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.0.0-canary.0 – 15.0.0-canary.205 Fixed in — No fix listed GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.0.1-canary.0 – 15.0.1-canary.3 Fixed in — No fix listed GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.0.2-canary.0 – 15.0.2-canary.11 Fixed in — No fix listed GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.0.3-canary.0 – 15.0.3-canary.9 Fixed in — No fix listed GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.0.4-canary.0 – 15.0.4-canary.52 Fixed in — No fix listed GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.1.1-canary.0 – 15.1.1-canary.27 Fixed in — No fix listed GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.2.0-canary.0 – 15.2.0-canary.77 Fixed in — No fix listed GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.2.1-canary.0 – 15.2.1-canary.6 Fixed in — No fix listed GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.2.2-canary.0 – 15.2.2-canary.7 Fixed in — No fix listed GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.3.0-canary.0 – 15.3.0-canary.46 Fixed in — No fix listed GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.3.1-canary.0 – 15.3.1-canary.15 Fixed in — No fix listed GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.4.0-canary.0 – 15.4.0-canary.130 Fixed in — No fix listed GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.4.2-canary.0 – 15.4.2-canary.56 Fixed in — No fix listed GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.5.1-canary.0 – 15.5.1-canary.39 Fixed in — No fix listed GHSA-5f7q-jpqc-wp7h
  • next (npm) Vendor— Affected 15.6.0-canary.0 to before 15.6.0-canary.61 Fixed in 15.6.0-canary.61 Patch available GHSA-5f7q-jpqc-wp7h

CPE configurations NVD · 63

CPEVersionsRoleVendor
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*15.0.0 to before 15.6.0; 16.0.0 to before 16.1.5Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*15.6.0Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*15.6.0 canary0Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*15.6.0 canary1Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*15.6.0 canary10Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*15.6.0 canary11Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*15.6.0 canary12Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*15.6.0 canary13Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*15.6.0 canary14Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*15.6.0 canary15Vulnerablevercel
  • cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions 15.0.0 to before 15.6.0; 16.0.0 to before 16.1.5 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:* Versions 15.6.0 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:* Versions 15.6.0 canary0 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:* Versions 15.6.0 canary1 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:* Versions 15.6.0 canary10 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:* Versions 15.6.0 canary11 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:* Versions 15.6.0 canary12 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:* Versions 15.6.0 canary13 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:* Versions 15.6.0 canary14 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:* Versions 15.6.0 canary15 Vulnerable ·vercel
Show 53 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:*15.6.0 canary16Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:*15.6.0 canary17Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:*15.6.0 canary18Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:*15.6.0 canary19Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:*15.6.0 canary2Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:*15.6.0 canary20Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:*15.6.0 canary21Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:*15.6.0 canary22Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:*15.6.0 canary23Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:*15.6.0 canary24Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:*15.6.0 canary25Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:*15.6.0 canary26Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:*15.6.0 canary27Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:*15.6.0 canary28Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:*15.6.0 canary29Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:*15.6.0 canary3Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:*15.6.0 canary30Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:*15.6.0 canary31Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:*15.6.0 canary32Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:*15.6.0 canary33Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:*15.6.0 canary34Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:*15.6.0 canary35Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:*15.6.0 canary36Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:*15.6.0 canary37Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:*15.6.0 canary38Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:*15.6.0 canary39Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:*15.6.0 canary4Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:*15.6.0 canary40Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:*15.6.0 canary41Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:*15.6.0 canary42Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:*15.6.0 canary43Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:*15.6.0 canary44Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:*15.6.0 canary45Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:*15.6.0 canary46Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:*15.6.0 canary47Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:*15.6.0 canary48Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:*15.6.0 canary49Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:*15.6.0 canary5Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:*15.6.0 canary50Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:*15.6.0 canary51Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:*15.6.0 canary52Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:*15.6.0 canary53Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:*15.6.0 canary54Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:*15.6.0 canary55Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:*15.6.0 canary56Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:*15.6.0 canary57Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary58:*:*:*:node.js:*:*15.6.0 canary58Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:*15.6.0 canary59Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:*15.6.0 canary6Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary60:*:*:*:node.js:*:*15.6.0 canary60Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:*15.6.0 canary7Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:*15.6.0 canary8Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:*15.6.0 canary9Vulnerablevercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:* Versions 15.6.0 canary16 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:* Versions 15.6.0 canary17 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:* Versions 15.6.0 canary18 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:* Versions 15.6.0 canary19 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:* Versions 15.6.0 canary2 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:* Versions 15.6.0 canary20 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:* Versions 15.6.0 canary21 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:* Versions 15.6.0 canary22 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:* Versions 15.6.0 canary23 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:* Versions 15.6.0 canary24 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:* Versions 15.6.0 canary25 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:* Versions 15.6.0 canary26 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:* Versions 15.6.0 canary27 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:* Versions 15.6.0 canary28 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:* Versions 15.6.0 canary29 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:* Versions 15.6.0 canary3 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:* Versions 15.6.0 canary30 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:* Versions 15.6.0 canary31 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:* Versions 15.6.0 canary32 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:* Versions 15.6.0 canary33 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:* Versions 15.6.0 canary34 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:* Versions 15.6.0 canary35 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:* Versions 15.6.0 canary36 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:* Versions 15.6.0 canary37 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:* Versions 15.6.0 canary38 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:* Versions 15.6.0 canary39 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:* Versions 15.6.0 canary4 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:* Versions 15.6.0 canary40 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:* Versions 15.6.0 canary41 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:* Versions 15.6.0 canary42 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:* Versions 15.6.0 canary43 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:* Versions 15.6.0 canary44 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:* Versions 15.6.0 canary45 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:* Versions 15.6.0 canary46 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:* Versions 15.6.0 canary47 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:* Versions 15.6.0 canary48 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:* Versions 15.6.0 canary49 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:* Versions 15.6.0 canary5 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:* Versions 15.6.0 canary50 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:* Versions 15.6.0 canary51 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:* Versions 15.6.0 canary52 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:* Versions 15.6.0 canary53 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:* Versions 15.6.0 canary54 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:* Versions 15.6.0 canary55 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:* Versions 15.6.0 canary56 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:* Versions 15.6.0 canary57 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary58:*:*:*:node.js:*:* Versions 15.6.0 canary58 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:* Versions 15.6.0 canary59 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:* Versions 15.6.0 canary6 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary60:*:*:*:node.js:*:* Versions 15.6.0 canary60 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:* Versions 15.6.0 canary7 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:* Versions 15.6.0 canary8 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:* Versions 15.6.0 canary9 Vulnerable ·vercel

Remediation

  • Fix · CNA next (vercel) Fixed in 15.0.0, 15.0.1, 15.0.2, 15.0.3, 15.0.4, 15.1.0, 15.1.1, 15.1.2, 15.1.3, 15.1.4, 15.1.5, 15.1.6, 15.1.7, 15.2.0, 15.2.1, 15.2.2, 15.2.3, 15.2.4, 15.2.5, 15.3.0, 15.3.1, 15.3.2, 15.1.8, 15.3.3, 15.4.0, 15.3.4, 15.3.5, 15.4.1, 15.4.2, 15.4.3, 15.4.4, 15.4.5, 15.4.6, 15.4.7, 15.5.0, 15.5.1, 15.5.2, 15.5.3, 15.5.4, 15.5.5, 15.5.6, 15.5.7, 15.4.8, 15.1.9, 15.0.5, 15.3.6, 15.2.6, 15.5.8, 15.4.9, 15.3.7, 15.2.7, 15.1.10, 15.0.6, 15.5.9, 15.4.10, 15.3.8, 15.2.8, 15.1.11, 15.0.7, 16.1.5
  • Fix · GHSA-5f7q-jpqc-wp7h next (npm) Fixed in 16.1.5 Advisory →
  • Fix · GHSA-5f7q-jpqc-wp7h next (npm) Fixed in 15.6.0-canary.61 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred
Red Hat Trusted Artifact SignerAffectedNo fix yet: Fix deferred
streams for Apache Kafka 2AffectedNo fix yet: Fix deferred
streams for Apache Kafka 3AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59472
  2. 2026-10-03 Alias added: GHSA-5f7q-jpqc-wp7h

References

Advisory 2

Other 2

  • TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
  • TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
  • TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
  • TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6
See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences