CVE-2026-44579

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

May 6, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.75% · Oct 27, 2026

A flaw was found in Next.js. Applications utilizing Partial Prerendering via the Cache Components feature are susceptible to connection exhaustion. A remote attacker can send crafted POST requests to a server action, triggering a request-body handling deadlock. This leaves connections open, consuming server resources and ultimately leading to a Denial of Service (DoS) for legitimate users. next.js: Next.js: Denial of Service via crafted POST requests to server actions This vulnerability is rated as Important as Next.js applications configured with Partial Prerendering and Cache Components are susceptible to a remote denial of service. An unauthenticated attacker can exhaust server connections by sending specially crafted POST requests, leading to a complete disruption of service for legitimate users. This impact is significant due to the potential for widespread unavailability of affected web applications. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.