6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27979

CVE-2026-27979: Next.js: Unbounded postponed resume buffering can lead to DoS

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the next-resume: 1 header (corresponding with a PPR resume request) would buffer request bodies without consistently enforcing maxPostponedStateSize in certain setups. The previous mitigation protected minimal-mode deployments, but equivalent non-minimal deployments remained vulnerable to the same unbounded postponed resume-body buffering behavior. In applications using the App Router with Partial Prerendering capability enabled (via experimental.ppr or cacheComponents), an attacker could send oversized next-resume POST payloads that were buffered without consistent size enforcement in non-minimal deployments, causing excessive memory usage and potential denial of service. This is fixed in version 16.1.7 by enforcing size limits across all postponed-body buffering paths and erroring when limits are exceeded. If upgrading is not immediately possible, block requests containing the next-resume header, as this is never valid to be sent from an untrusted client.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27979

CVE-2026-27979:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
next	npm	>= 16.0.1, < 16.1.7	16.1.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-h27x-g6w4-24gq, describes an unbounded request body buffering issue in Next.js's Partial Prerendering (PPR) feature, leading to a potential Denial of Service. The analysis of the fixing commit, c885d4825f800dd1e49ead37274dcd08cdd6f3f1, pinpoints the exact location of the flaw.

The patch modifies two main files, packages/next/src/build/templates/app-page.ts and packages/next/src/server/base-server.ts, and introduces a new utility file packages/next/src/server/lib/postponed-request-body.ts containing the fix logic in the readBodyWithSizeLimit function.

The advisory mentions that a previous mitigation was incomplete and only protected 'minimal-mode' deployments. The code changes confirm this. The logic in base-server.ts already contained a size check, which was refactored to use the new centralized function. However, the code in packages/next/src/build/templates/app-page.ts within the exported handler function was missing this check entirely.

Specifically, the handler function in app-page.ts contained a for await...of loop that read all chunks from the request stream (req) and buffered them in an array before concatenating them. This is the vulnerable code path, as it doesn't validate the size of the incoming data. An attacker could exploit this by sending a POST request with the next-resume: 1 header and a multi-gigabyte body, causing the server's memory usage to spike, leading to a crash.

Therefore, the handler function is the primary vulnerable function. During exploitation, a runtime profiler would show this function being executed as it processes the malicious request that causes the memory exhaustion.

Vulnerable functions

handler

packages/next/src/build/templates/app-page.ts

The `handler` function processes requests for App Router pages. For Partial Prerendering (PPR) resume requests (indicated by the 'next-resume: 1' header), the vulnerable version of the code would read the entire request body into a buffer in memory without enforcing any size limit. An attacker could send a POST request with a very large body, causing the server to exhaust its memory, resulting in a Denial of Service. The patch replaces this unbounded buffering with a call to `readBodyWithSizeLimit`, which enforces the configured `maxPostponedStateSize`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.