Next.js Denial-of-Service Vulnerability in Server Actions

A denial-of-service vulnerability has been identified in Next.js versions 13.0.0 prior to 13.5.8, 14.2.21, and 15.0.0 prior to 15.1.1. This vulnerability allows attackers to create requests that disrupt Server Actions by keeping them open until the hosting provider terminates the execution. During this time, the Next.js server remains idle, only maintaining the connection with low CPU and memory usage. This issue is particularly problematic for deployments on providers that charge based on response times, such as Vercel or Netlify, where default function execution limits are in place to prevent excessive costs. The vulnerability arises in environments lacking safeguards against prolonged Server Action processes, and it mirrors the effects of an HTTP request with an invalid 'Content-Length' header or one that fails to close properly.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, where Server Action requests are left hanging, causing disruptions until the hosting provider cancels the execution. This vulnerability can also be exploited as a denial-of-wallet attack on providers that bill based on response times.

Remediation

Users are advised to upgrade to Next.js versions 13.5.8, 14.2.21, or 15.1.2. There are no official workarounds for this vulnerability.