CVE-2026-44579

A flaw was found in Next.js. Applications utilizing Partial Prerendering via the Cache Components feature are susceptible to connection exhaustion. A remote attacker can send crafted POST requests to a server action, triggering a request-body handling deadlock. This leaves connections open, consuming server resources and ultimately leading to a Denial of Service (DoS) for legitimate users.

This vulnerability is rated as Important as Next.js applications configured with Partial Prerendering and Cache Components are susceptible to a remote denial of service. An unauthenticated attacker can exhaust server connections by sending specially crafted POST requests, leading to a complete disruption of service for legitimate users. This impact is significant due to the potential for widespread unavailability of affected web applications.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.