Next.js Allows a Denial of Service (DoS) with Server Actions
Published 3 Jan 2025 · Updated 10 Sept 2026
Affected packages
- Affected
- >=13.0.0 <13.5.8
- Fixed in
- 13.5.8
npm install next@13.5.8- Affected
- >=14.0.0 <14.2.21
- Fixed in
- 14.2.21
npm install next@14.2.21- Affected
- >=15.0.0 <15.1.2
- Fixed in
- 15.1.2
npm install next@15.1.2Details
Impact
A Denial of Service (DoS) attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution.
_Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time._
Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing.
This is the same issue as if the incoming HTTP request has an invalid Content-Length header or never closes. If the host has no other mitigations to those then this vulnerability is novel.
This vulnerability affects only Next.js deployments using Server Actions.
Patches
This vulnerability was resolved in Next.js 14.2.21, 15.1.2, and 13.5.8. We recommend that users upgrade to a safe version.
Workarounds
There are no official workarounds for this vulnerability.
Credits
Thanks to the PackDraw team for responsibly disclosing this vulnerability.
Is GHSA-7m27-7ghc-44w9 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.