7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44579

CVE-2026-44579: Next.js: Denial of Service via connection exhaustion in applications using Cache Components

Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44579

CVE-2026-44579:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
next	npm	>= 15.0.0, < 15.5.16	15.5.16
next	npm	>= 16.0.0, < 16.2.5	16.2.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service in Next.js applications using Cache Components. It can be triggered by a crafted POST request containing a Next-Resume header, which causes a deadlock in the request-body handling logic. The analysis of the patches revealed that the fix for this vulnerability is implemented in the commit 9d50c0b7190f59c470308578e12882788819f14c. This commit modifies the INTERNAL_HEADERS constant in packages/next/src/server/lib/server-ipc/utils.ts, which is used by the filterInternalHeaders function. By adding 'next-resume' to this list, the header is stripped from incoming requests, preventing the deadlock. The vulnerable function is therefore the one that processes this header, but the most direct and evidence-based function to identify from the patch is filterInternalHeaders, as its previous, incomplete implementation is what allowed the vulnerability to be triggered.

Vulnerable functions

filterInternalHeaders

packages/next/src/server/lib/server-ipc/utils.ts

The vulnerability is caused by a request-body handling deadlock when a POST request with a `Next-Resume` header is sent to a server action. The fix is to strip this header from incoming requests. The `filterInternalHeaders` function is responsible for this filtering. The patch adds the `next-resume` header to the list of internal headers to be stripped. Before the patch, this function did not filter the `Next-Resume` header, allowing malicious requests to trigger the deadlock. Therefore, the incomplete implementation of `filterInternalHeaders` is the root cause of the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.