next.js: Next.js: Denial of Service via crafted POST requests to server actions

🗓️ 12 Aug 2026 19:35:14Reported by RedHatType

Crafted POST requests to Next.js server actions cause request-body deadlock, exhausting connections and causing DoS.

Reporter	Title	Published	Views	Family All 34
GithubExploit	patch-to-exploit	26 May 202616:02	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple packages which are vulnerable to multiple CVEs.	8 Jul 202610:39	–	ibm
BDU FSTEC	The vulnerability of the Next.js software platform for creating web applications, related to unlimited resource distribution, allows attackers to trigger service failures.	2 Jul 202600:00	–	bdu_fstec
Chainguard	CVE-2026-44579 vulnerabilities	13 May 202601:17	–	cgr
Circl	CVE-2026-44579	8 May 202612:09	–	circl
CNNVD	Next.js 安全漏洞	13 May 202600:00	–	cnnvd
CVE	CVE-2026-44579	13 May 202617:04	–	cve
Cvelist	CVE-2026-44579 Next.js: Denial of Service via connection exhaustion in applications using Cache Components	13 May 202617:04	–	cvelist
F5 Networks	K000163007: Next.js vulnerability CVE-2026-44579	20 Aug 202610:43	–	f5
Github Security Blog	Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components	11 May 202615:56	–	github

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-44579
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-44579
cve	www.cve.org/CVERecord

20 Aug 2026 22:53Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

EPSS0.00746

SSVC