CVE-2025-59472

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-59472
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59472.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-59472
Aliases
Related
Published
2026-01-26T22:15:53.027Z
Modified
2026-03-13T03:39:33.377589Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:

  1. Unbounded request body buffering: The server buffers the entire POST request body into memory using Buffer.concat() without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.

  2. Unbounded decompression (zipbomb): The resume data cache is decompressed using inflateSync() without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.

Both attack vectors result in a fatal V8 out-of-memory error (FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.

To be affected you must have an application running with experimental.ppr: true or cacheComponents: true configured along with the NEXTPRIVATEMINIMAL_MODE=1 environment variable.

Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.

References

Affected packages

Git / github.com/vercel/next.js

Affected ranges

Type
GIT
Repo
https://github.com/vercel/next.js
Events
Introduced
51bfe3c1863b191f4b039bc230e8ed5c57b0baf3
Fixed
c654bec6eb08382ed2ef47c90317039b6693f62a
Introduced
950609f96f694c5475d18cd2d72a0052ca04d4b9
Fixed
acba4a6b9f48e0a067c592dac322410c0e122018
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c654bec6eb08382ed2ef47c90317039b6693f62a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c654bec6eb08382ed2ef47c90317039b6693f62a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4d82a4aa13ff4d5f9b0179dcaa185666df617756
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
03250cd04344ba2a527763d08b3976bf29dff226
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f27212108372c13acf795ceec1e169405c177815
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
12a6ee4b212bc49c9ec6f339e55ca2b5b18d663c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
74b226fe4afc7149901affc3c005476e9e592315
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
92f23dae971044dfb49f7bbbf29f02c64f6ce7b3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b99b353f52745ad03783b99fad8d2eb287f03fad
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9db775049edc7e0ee29c7551492c202e01829c8d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7fb8bfe685a117ca87332ab5366efcda8fdbcb82
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c072d53ce28cb680f7207e789b6b9951a21b0a8d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
630798355931c8b24d7067aac6ff9519f201a01d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ea034f6ff96e54ddab4b81796ae5ad7232e05ede
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d608590ced4f592c9939c841b9814c121bb6b20d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e9e5eca47b935abaffc1321bd8896a498dc3c636
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
de19200deb33869fc691b43e68aef76493d79fa1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
42cc1a85888311a7f0745fd68fb29e4767b1d9e3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
49b83495aab6cd7d9ad74126f93ec3917bedc4e5
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
088a519039d319ab2a48d7963d717647d943190d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7d9b384d1be37308484d96bc4816d435bd22ff55
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ee87a4bb223c4270e088d97a15a6a9ad3a2d1d1f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e8a1342e0ec2b576465ae33e1c7392c92703e7ec
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
dbdf9ca95273198d56bef531eeb127fc38f8f8e0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
33016f3c55f4595f2601fe9d5ced8f7c675cf7fc
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6bf58cc8cba154d5f8e0d14ceabab3f95bf7e51b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a9c4a8c8fb11a235d08328225532a0b8bf9c93de
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c298d7042f89ac8933e3848a39788217535cdef8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6d318d618fae8e1a04624abb83a107a1d4df5ab2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9f329f5a69447f328f1a635ab9bdb3d228426491
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d300ee9930d2e2d28f5c4dce1dc7e4fe5a62d78e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
43b8e3d6ad5acc569be6c1c12ee73dff04949c66
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7182f909aeed45c7d791bc6f49b3afcaec8cebfe
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
bc2fa389b11263ecb6beccfd97a8b4fe2e3dad0f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2330e144ff88fe557b24a9320770ad808041d99f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
67ca1e9519ed3007372baef06a58432e8965d35e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6f2c64048f8cd4ba6d51beb3f3b2e00aceace2f7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
16bc1455dc928b18cea93a55b65c4b02a99da63c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5faac816559bbca7a984c9a56c89f9f880ffbfd4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d4eb8915334320a39a376b409fb2e359a630d57c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
665977f2c7b124ba2f1f132d6ba4e3793a2aea49
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7c0c2c6b86fe3bd44f205a2677f3622ba3fb8700
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8acd54a8c807671b016ad9e02f108739c6563a43
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a6c48f029d7292af04dcb525a85269f92a7f1e96
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1da862828f4a9fccac2a2499d27f32cab4fd3882
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
52a26cdb0ccb8c27d1c484aa22c46d2c9332890e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
fc307c4f23b18a054cdc6dfb5453749a2947b1a0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f69066fb20b29e591b40ff20e41181391bda1477
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2cc84abc6254c4dec1c51ac7945300a03e9e51be
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ed2e69df89c206d68a4ce227cda5d71e49e83290
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
69e3e629b6ea5ec67b6dca0a47bd4e7ba6eb70d4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
79e78381c62149e8bc49696e140085e156444e61
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8d475c5468b18cb3aad0de0a50632953d5243db1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e2713a423002420b3d12f6fa946205581d1151e3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
73a4d0829a8e6a53af5be9c52bcf466e4941344c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
460e0f6747d93770dae9896d96eea6b2f4e2bb3f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
32199eaab69e562cae2c31642d33d1367c37c778
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
323eebcee7f15d4c880654ed9cd3b46c49e80dc7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e1463b394e6473e42997bb1b6a1269e37ac54d3e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f7a88eb6c2f77c4e07c7dc23b9a7c822d3c0b03d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
844abcac192d702161531468996eadfd1a1c4f13
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
33759e0be7d31f8a5d59544267f7ec9b914f37e5
Database specific 
{
    "versions": [
        {
            "introduced": "15.0.0"
        },
        {
            "fixed": "15.6.0"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.1.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary12"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary13"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary14"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary15"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary16"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary17"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary18"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary19"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary20"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary21"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary22"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary23"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary24"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary25"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary26"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary27"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary28"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary29"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary30"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary31"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary32"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary33"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary34"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary35"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary36"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary37"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary38"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary39"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary40"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary41"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary42"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary43"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary44"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary45"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary46"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary47"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary48"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary49"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary50"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary51"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary52"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary53"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary54"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary55"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary56"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary57"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary58"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary59"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary60"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary9"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59472.json"