Next.js Framework 15.x < 15.6.0-canary.61 / 16.x < 16.1.5 PPR Resume Endpoint DoS (GHSA-5f7q-jpqc-wp7h)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(297815);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id("CVE-2025-59472");
  script_xref(name:"IAVA", value:"2026-A-0090-S");

  script_name(english:"Next.js Framework 15.x < 15.6.0-canary.61 / 16.x < 16.1.5 PPR Resume Endpoint DoS (GHSA-5f7q-jpqc-wp7h)");

  script_set_attribute(attribute:"synopsis", value:
"The Next.js Framework on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Next.js Framework on the remote host is affected by a denial of service vulnerability:

  - A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when
    running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1
    header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an
    attacker to crash the server process through memory exhaustion: unbounded request body buffering where the
    server buffers the entire POST request body into memory using Buffer.concat() without enforcing any size limit,
    and unbounded decompression (zipbomb) where the resume data cache is decompressed using inflateSync() without
    limiting the decompressed output size. Both attack vectors result in a fatal V8 out-of-memory error causing
    the Node.js process to terminate. (CVE-2025-59472)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3f0675bd");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Next.js Framework version 15.6.0-canary.61, 16.1.5 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-59472");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vercel:next.js");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

get_kb_item_or_exit('Host/nodejs/modules/enumerated');

# handle canary builds, e.g. 15.6.0-canary.61
vcf::add_separator('-');
vcf::add_conversions({'canary':-25});

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'next');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'next');

var constraints;

if (app_info.version =~ "15(\.\d+)+-canary(\.\d+)+")
  constraints = [{'fixed_version':'15.6.0-canary.61'}];
else
  constraints = [
    {'min_version':'15.0.0', 'fixed_version':'16.1.5'}
  ];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);