HighGHSA-fq54-2j52-jc42CVE-2024-39693

Next.js Denial of Service (DoS) condition

Published 10 Jul 2024 · Updated 10 Sept 2026

Affected package

Affected: >=13.3.1 <13.5.0
Fixed in: 13.5.0

Update to the fixed version for your release line, for example:npm install next@13.5.0

Details

Impact

A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server.

This vulnerability can affect all Next.js deployments on the affected versions.

Patches

This vulnerability was resolved in Next.js 13.5 and later. We recommend that users upgrade to a safe version.

Workarounds

There are no official workarounds for this vulnerability.

Credit

Thai Vu of flyseccorp.com
Aonan Guan (@0dd), Senior Cloud Security Engineer

Is GHSA-fq54-2j52-jc42 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.