Next.js Denial of Service (DoS) condition

HOCH 7.5CVE-2024-39693 · GHSA-fq54-2j52-jc42 · Published 10/07/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
next.js vercel	`≥ 13.3.1, < 13.5.0`	`13.5.0`
next npm	`≥ 13.3.1, < 13.5.0`	`13.5.0`

Description

Impact

A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server.

This vulnerability can affect all Next.js deployments on the affected versions.

Patches

This vulnerability was resolved in Next.js 13.5 and later. We recommend that users upgrade to a safe version.

Workarounds

There are no official workarounds for this vulnerability.

Credit

Thai Vu of flyseccorp.com
Aonan Guan (@0dd), Senior Cloud Security Engineer

NVD description

Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. his vulnerability was resolved in Next.js 13.5 and later.

References

vercel/next.js security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-39693 · ADVISORY
vercel/next.js · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free