Denial of Service Vulnerability in Next.js for Vercel Applications
CVE-2025-59472

5.9MEDIUM

Key Information:

Vendor

Vercel
Status
Next
Vendor
CVE Published:
26 January 2026

What is CVE-2025-59472?

A denial of service vulnerability affects Next.js when Partial Prerendering (PPR) is enabled and running in minimal mode. This flaw permits unauthenticated POST requests to the PPR resume endpoint, allowing attackers to exploit memory management issues. Specifically, the absence of size limits for request body buffering can lead to excessive memory use, while unbounded decompression techniques can cause servers to fail under the weight of large payloads. Applications must be configured appropriately to be at risk, making it imperative to upgrade to safer versions to mitigate this issue.

Affected Version(s)

next 15.0.0-canary.0 < 15.0.0

next 15.0.1-canary.0 < 15.0.1

next 15.0.2-canary.0 < 15.0.2

References

https://github.com/vercel/next.js/security/advisories/GHS...

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.