CVE-2024-56332

A flaw was found in Next.js package. A denial of service (DoS) attack allows attackers to construct requests that leave requests to Server Actions hanging until the hosting provider cancels the function execution. The Next.js server is idle during that time and only keeps the connection open. The CPU and memory footprint are low during that time. This is the same issue as if the incoming HTTP request has an invalid Content-Length header or never closes. This vulnerability is novel if the host has no other mitigations for those.

This vulnerability affects only Next.js deployments using Server Actions.

Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.