Next.js Unbounded Buffering Vulnerability in POST Requests with Partial Prerendering

A vulnerability in Next.js versions 16.0.1 prior to 16.1.7 allows for unbounded buffering of request bodies in POST requests that include the 'next-resume: 1' header. This issue arises in non-minimal deployments when the App Router's Partial Prerendering capability is enabled. The vulnerability can lead to excessive memory usage and potential denial-of-service conditions.

Impact

Exploitation of this vulnerability can cause excessive memory consumption, leading to potential denial-of-service conditions.

Reproduction

To reproduce this vulnerability, send a POST request to a Next.js application with the 'next-resume: 1' header and an oversized payload. Ensure that the application is using the App Router with Partial Prerendering enabled, and that it is a non-minimal deployment.

Remediation

Users can upgrade to Next.js version 16.1.7 or later. If an immediate upgrade is not possible, block requests containing the 'next-resume' header.