CVE-2025-59472

A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion: 1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory. 2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion. Both attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server. To be affected you must have an application running with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable. Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.

• CWE-400

• https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7hVendor Advisory

Published

Jan 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59467A Cross-Site Scripting (XSS) vulnerability in the UCRM Argen…9.6
• CVE-2025-59468This vulnerability allows a Backup Administrator to perform …9.1
• CVE-2025-59469This vulnerability allows a Backup or Tape Operator to write…9
• CVE-2025-5947The Service Finder Bookings plugin for WordPress is vulnerab…9.8
• CVE-2025-59470This vulnerability allows a Backup Operator to perform remot…9
• CVE-2025-59471A denial of service vulnerability exists in self-hosted Next…7.5
• CVE-2025-59473SQL Injection vulnerability in the Structure for Admin authe…7.2
• CVE-2025-59474Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not …5.3
• CVE-2025-59475Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not …4.3
• CVE-2025-59476Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not …5.3
• CVE-2025-59478When a BIG-IP AFM denial-of-service (DoS) protection profile…8.7
• CVE-2025-59479CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with im…6.1