ROOT-APP-NPM-CVE-2026-27979 CVE-2026-27979 in next - Patched by Root

Root has patched CVE-2026-27979 in the next package for Root:npm. Multiple fixed versions available...

CVE-2026-27979 Next.js: Unbounded postponed resume buffering can lead to DoS

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the next-resume: 1 header corresponding with a PPR resume request would buffer request bodies without consistently enforcing maxPostponedStateSize in...