VDB
Sign up
MEDIUM5.3

GHSA-7m27-7ghc-44w9

Next.js Allows a Denial of Service (DoS) with Server Actions

Quick fix

GHSA-7m27-7ghc-44w9 — next: upgrade to the fixed version with the command below.

npm install next@13.5.8

Details

### Impact A Denial of Service (DoS) attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution.

_Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time._

Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing.

This is the same issue as if the incoming HTTP request has an invalid `Content-Length` header or never closes. If the host has no other mitigations to those then this vulnerability is novel.

This vulnerability affects only Next.js deployments using Server Actions.

### Patches

This vulnerability was resolved in Next.js 14.2.21, 15.1.2, and 13.5.8. We recommend that users upgrade to a safe version.

### Workarounds

There are no official workarounds for this vulnerability.

### Credits

Thanks to the PackDraw team for responsibly disclosing this vulnerability.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/next
Introduced in: 13.0.0Fixed in: 13.5.8
Fixnpm install next@13.5.8
npm/next
Introduced in: 14.0.0Fixed in: 14.2.21
Fixnpm install next@14.2.21
npm/next
Introduced in: 15.0.0Fixed in: 15.1.2
Fixnpm install next@15.1.2

References