CVE-2026-44579High· 7.5▾ MidnightPoC availableNext.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through cr…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
0.5% → 0.7%
1 GitHub repo
Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.
next.js >= 15.0.0, < 15.5.16next.js >= 16.0.0, < 16.2.5Upgrade past the affected range:
next.js 16.2.5Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44577Medium· 5.9Next.js is a React framework for building full-stack web applications
CVE-2026-44578High· 8.6Next.js is a React framework for building full-stack web applications
CVE-2026-45109High· 7.5Next.js is a React framework for building full-stack web applications
CVE-2026-44575High· 7.5Next.js is a React framework for building full-stack web applications
CVE-2026-44574High· 8.1Next.js is a React framework for building full-stack web applications
CVE-2026-44573High· 7.5Next.js is a React framework for building full-stack web applications