CVE-2025-59472

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-59472", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2025-09-16T15:00:07.876Z", "datePublished": "2026-01-26T21:43:05.099Z", "dateUpdated": "2026-01-27T14:54:04.986Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:\n\n1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.\n\n2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.\n\nBoth attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.\n\nTo be affected you must have an application running with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.\n\nStrongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications."}], "affected": [{"defaultStatus": "unaffected", "vendor": "vercel", "product": "next", "versions": [{"version": "15.0.0-canary.0", "status": "affected", "lessThan": "15.0.0", "versionType": "semver"}, {"version": "15.0.1-canary.0", "status": "affected", "lessThan": "15.0.1", "versionType": "semver"}, {"version": "15.0.2-canary.0", "status": "affected", "lessThan": "15.0.2", "versionType": "semver"}, {"version": "15.0.3-canary.0", "status": "affected", "lessThan": "15.0.3", "versionType": "semver"}, {"version": "15.0.4-canary.0", "status": "affected", "lessThan": "15.0.4", "versionType": "semver"}, {"version": "15.1.0-canary.0", "status": "affected", "lessThan": "15.1.0", "versionType": "semver"}, {"version": "15.1.1-canary.0", "status": "affected", "lessThan": "15.1.1", "versionType": "semver"}, {"version": "15.1.2-canary.0", "status": "affected", "lessThan": "15.1.2", "versionType": "semver"}, {"version": "15.1.3-canary.0", "status": "affected", "lessThan": "15.1.3", "versionType": "semver"}, {"version": "15.1.4-canary.0", "status": "affected", "lessThan": "15.1.4", "versionType": "semver"}, {"version": "15.1.5-canary.0", "status": "affected", "lessThan": "15.1.5", "versionType": "semver"}, {"version": "15.1.6-canary.0", "status": "affected", "lessThan": "15.1.6", "versionType": "semver"}, {"version": "15.1.7-canary.0", "status": "affected", "lessThan": "15.1.7", "versionType": "semver"}, {"version": "15.2.0-canary.0", "status": "affected", "lessThan": "15.2.0", "versionType": "semver"}, {"version": "15.2.1-canary.0", "status": "affected", "lessThan": "15.2.1", "versionType": "semver"}, {"version": "15.2.2-canary.0", "status": "affected", "lessThan": "15.2.2", "versionType": "semver"}, {"version": "15.2.3-canary.0", "status": "affected", "lessThan": "15.2.3", "versionType": "semver"}, {"version": "15.2.4-canary.0", "status": "affected", "lessThan": "15.2.4", "versionType": "semver"}, {"version": "15.2.5-canary.0", "status": "affected", "lessThan": "15.2.5", "versionType": "semver"}, {"version": "15.3.0-canary.0", "status": "affected", "lessThan": "15.3.0", "versionType": "semver"}, {"version": "15.3.1-canary.0", "status": "affected", "lessThan": "15.3.1", "versionType": "semver"}, {"version": "15.3.2-canary.0", "status": "affected", "lessThan": "15.3.2", "versionType": "semver"}, {"version": "15.1.8-canary.0", "status": "affected", "lessThan": "15.1.8", "versionType": "semver"}, {"version": "15.3.3-canary.0", "status": "affected", "lessThan": "15.3.3", "versionType": "semver"}, {"version": "15.4.0-canary.0", "status": "affected", "lessThan": "15.4.0", "versionType": "semver"}, {"version": "15.3.4-canary.0", "status": "affected", "lessThan": "15.3.4", "versionType": "semver"}, {"version": "15.3.5-canary.0", "status": "affected", "lessThan": "15.3.5", "versionType": "semver"}, {"version": "15.4.1-canary.0", "status": "affected", "lessThan": "15.4.1", "versionType": "semver"}, {"version": "15.4.2-canary.0", "status": "affected", "lessThan": "15.4.2", "versionType": "semver"}, {"version": "15.4.3-canary.0", "status": "affected", "lessThan": "15.4.3", "versionType": "semver"}, {"version": "15.4.4-canary.0", "status": "affected", "lessThan": "15.4.4", "versionType": "semver"}, {"version": "15.4.5-canary.0", "status": "affected", "lessThan": "15.4.5", "versionType": "semver"}, {"version": "15.4.6-canary.0", "status": "affected", "lessThan": "15.4.6", "versionType": "semver"}, {"version": "15.4.7-canary.0", "status": "affected", "lessThan": "15.4.7", "versionType": "semver"}, {"version": "15.5.0-canary.0", "status": "affected", "lessThan": "15.5.0", "versionType": "semver"}, {"version": "15.5.1-canary.0", "status": "affected", "lessThan": "15.5.1", "versionType": "semver"}, {"version": "15.5.2-canary.0", "status": "affected", "lessThan": "15.5.2", "versionType": "semver"}, {"version": "15.5.3-canary.0", "status": "affected", "lessThan": "15.5.3", "versionType": "semver"}, {"version": "15.5.4-canary.0", "status": "affected", "lessThan": "15.5.4", "versionType": "semver"}, {"version": "15.5.5-canary.0", "status": "affected", "lessThan": "15.5.5", "versionType": "semver"}, {"version": "15.5.6-canary.0", "status": "affected", "lessThan": "15.5.6", "versionType": "semver"}, {"version": "15.5.7-canary.0", "status": "affected", "lessThan": "15.5.7", "versionType": "semver"}, {"version": "15.4.8-canary.0", "status": "affected", "lessThan": "15.4.8", "versionType": "semver"}, {"version": "15.1.9-canary.0", "status": "affected", "lessThan": "15.1.9", "versionType": "semver"}, {"version": "15.0.5-canary.0", "status": "affected", "lessThan": "15.0.5", "versionType": "semver"}, {"version": "15.3.6-canary.0", "status": "affected", "lessThan": "15.3.6", "versionType": "semver"}, {"version": "15.2.6-canary.0", "status": "affected", "lessThan": "15.2.6", "versionType": "semver"}, {"version": "15.5.8-canary.0", "status": "affected", "lessThan": "15.5.8", "versionType": "semver"}, {"version": "15.4.9-canary.0", "status": "affected", "lessThan": "15.4.9", "versionType": "semver"}, {"version": "15.3.7-canary.0", "status": "affected", "lessThan": "15.3.7", "versionType": "semver"}, {"version": "15.2.7-canary.0", "status": "affected", "lessThan": "15.2.7", "versionType": "semver"}, {"version": "15.1.10-canary.0", "status": "affected", "lessThan": "15.1.10", "versionType": "semver"}, {"version": "15.0.6-canary.0", "status": "affected", "lessThan": "15.0.6", "versionType": "semver"}, {"version": "15.5.9-canary.0", "status": "affected", "lessThan": "15.5.9", "versionType": "semver"}, {"version": "15.4.10-canary.0", "status": "affected", "lessThan": "15.4.10", "versionType": "semver"}, {"version": "15.3.8-canary.0", "status": "affected", "lessThan": "15.3.8", "versionType": "semver"}, {"version": "15.2.8-canary.0", "status": "affected", "lessThan": "15.2.8", "versionType": "semver"}, {"version": "15.1.11-canary.0", "status": "affected", "lessThan": "15.1.11", "versionType": "semver"}, {"version": "15.0.7-canary.0", "status": "affected", "lessThan": "15.0.7", "versionType": "semver"}, {"version": "16.1.0", "status": "affected", "lessThan": "16.1.5", "versionType": "semver"}]}], "references": [{"url": "https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-01-26T21:43:05.099Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T14:52:42.677682Z", "id": "CVE-2025-59472", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T14:54:04.986Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59472", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-27T14:52:42.677682Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T14:53:59.720Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "vercel", "product": "next", "versions": [{"status": "affected", "version": "15.0.0-canary.0", "lessThan": "15.0.0", "versionType": "semver"}, {"status": "affected", "version": "15.0.1-canary.0", "lessThan": "15.0.1", "versionType": "semver"}, {"status": "affected", "version": "15.0.2-canary.0", "lessThan": "15.0.2", "versionType": "semver"}, {"status": "affected", "version": "15.0.3-canary.0", "lessThan": "15.0.3", "versionType": "semver"}, {"status": "affected", "version": "15.0.4-canary.0", "lessThan": "15.0.4", "versionType": "semver"}, {"status": "affected", "version": "15.1.0-canary.0", "lessThan": "15.1.0", "versionType": "semver"}, {"status": "affected", "version": "15.1.1-canary.0", "lessThan": "15.1.1", "versionType": "semver"}, {"status": "affected", "version": "15.1.2-canary.0", "lessThan": "15.1.2", "versionType": "semver"}, {"status": "affected", "version": "15.1.3-canary.0", "lessThan": "15.1.3", "versionType": "semver"}, {"status": "affected", "version": "15.1.4-canary.0", "lessThan": "15.1.4", "versionType": "semver"}, {"status": "affected", "version": "15.1.5-canary.0", "lessThan": "15.1.5", "versionType": "semver"}, {"status": "affected", "version": "15.1.6-canary.0", "lessThan": "15.1.6", "versionType": "semver"}, {"status": "affected", "version": "15.1.7-canary.0", "lessThan": "15.1.7", "versionType": "semver"}, {"status": "affected", "version": "15.2.0-canary.0", "lessThan": "15.2.0", "versionType": "semver"}, {"status": "affected", "version": "15.2.1-canary.0", "lessThan": "15.2.1", "versionType": "semver"}, {"status": "affected", "version": "15.2.2-canary.0", "lessThan": "15.2.2", "versionType": "semver"}, {"status": "affected", "version": "15.2.3-canary.0", "lessThan": "15.2.3", "versionType": "semver"}, {"status": "affected", "version": "15.2.4-canary.0", "lessThan": "15.2.4", "versionType": "semver"}, {"status": "affected", "version": "15.2.5-canary.0", "lessThan": "15.2.5", "versionType": "semver"}, {"status": "affected", "version": "15.3.0-canary.0", "lessThan": "15.3.0", "versionType": "semver"}, {"status": "affected", "version": "15.3.1-canary.0", "lessThan": "15.3.1", "versionType": "semver"}, {"status": "affected", "version": "15.3.2-canary.0", "lessThan": "15.3.2", "versionType": "semver"}, {"status": "affected", "version": "15.1.8-canary.0", "lessThan": "15.1.8", "versionType": "semver"}, {"status": "affected", "version": "15.3.3-canary.0", "lessThan": "15.3.3", "versionType": "semver"}, {"status": "affected", "version": "15.4.0-canary.0", "lessThan": "15.4.0", "versionType": "semver"}, {"status": "affected", "version": "15.3.4-canary.0", "lessThan": "15.3.4", "versionType": "semver"}, {"status": "affected", "version": "15.3.5-canary.0", "lessThan": "15.3.5", "versionType": "semver"}, {"status": "affected", "version": "15.4.1-canary.0", "lessThan": "15.4.1", "versionType": "semver"}, {"status": "affected", "version": "15.4.2-canary.0", "lessThan": "15.4.2", "versionType": "semver"}, {"status": "affected", "version": "15.4.3-canary.0", "lessThan": "15.4.3", "versionType": "semver"}, {"status": "affected", "version": "15.4.4-canary.0", "lessThan": "15.4.4", "versionType": "semver"}, {"status": "affected", "version": "15.4.5-canary.0", "lessThan": "15.4.5", "versionType": "semver"}, {"status": "affected", "version": "15.4.6-canary.0", "lessThan": "15.4.6", "versionType": "semver"}, {"status": "affected", "version": "15.4.7-canary.0", "lessThan": "15.4.7", "versionType": "semver"}, {"status": "affected", "version": "15.5.0-canary.0", "lessThan": "15.5.0", "versionType": "semver"}, {"status": "affected", "version": "15.5.1-canary.0", "lessThan": "15.5.1", "versionType": "semver"}, {"status": "affected", "version": "15.5.2-canary.0", "lessThan": "15.5.2", "versionType": "semver"}, {"status": "affected", "version": "15.5.3-canary.0", "lessThan": "15.5.3", "versionType": "semver"}, {"status": "affected", "version": "15.5.4-canary.0", "lessThan": "15.5.4", "versionType": "semver"}, {"status": "affected", "version": "15.5.5-canary.0", "lessThan": "15.5.5", "versionType": "semver"}, {"status": "affected", "version": "15.5.6-canary.0", "lessThan": "15.5.6", "versionType": "semver"}, {"status": "affected", "version": "15.5.7-canary.0", "lessThan": "15.5.7", "versionType": "semver"}, {"status": "affected", "version": "15.4.8-canary.0", "lessThan": "15.4.8", "versionType": "semver"}, {"status": "affected", "version": "15.1.9-canary.0", "lessThan": "15.1.9", "versionType": "semver"}, {"status": "affected", "version": "15.0.5-canary.0", "lessThan": "15.0.5", "versionType": "semver"}, {"status": "affected", "version": "15.3.6-canary.0", "lessThan": "15.3.6", "versionType": "semver"}, {"status": "affected", "version": "15.2.6-canary.0", "lessThan": "15.2.6", "versionType": "semver"}, {"status": "affected", "version": "15.5.8-canary.0", "lessThan": "15.5.8", "versionType": "semver"}, {"status": "affected", "version": "15.4.9-canary.0", "lessThan": "15.4.9", "versionType": "semver"}, {"status": "affected", "version": "15.3.7-canary.0", "lessThan": "15.3.7", "versionType": "semver"}, {"status": "affected", "version": "15.2.7-canary.0", "lessThan": "15.2.7", "versionType": "semver"}, {"status": "affected", "version": "15.1.10-canary.0", "lessThan": "15.1.10", "versionType": "semver"}, {"status": "affected", "version": "15.0.6-canary.0", "lessThan": "15.0.6", "versionType": "semver"}, {"status": "affected", "version": "15.5.9-canary.0", "lessThan": "15.5.9", "versionType": "semver"}, {"status": "affected", "version": "15.4.10-canary.0", "lessThan": "15.4.10", "versionType": "semver"}, {"status": "affected", "version": "15.3.8-canary.0", "lessThan": "15.3.8", "versionType": "semver"}, {"status": "affected", "version": "15.2.8-canary.0", "lessThan": "15.2.8", "versionType": "semver"}, {"status": "affected", "version": "15.1.11-canary.0", "lessThan": "15.1.11", "versionType": "semver"}, {"status": "affected", "version": "15.0.7-canary.0", "lessThan": "15.0.7", "versionType": "semver"}, {"status": "affected", "version": "16.1.0", "lessThan": "16.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h"}], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:\n\n1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.\n\n2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.\n\nBoth attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.\n\nTo be affected you must have an application running with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.\n\nStrongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications."}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-01-26T21:43:05.099Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59472", "state": "PUBLISHED", "dateUpdated": "2026-01-27T14:54:04.986Z", "dateReserved": "2025-09-16T15:00:07.876Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-01-26T21:43:05.099Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "next", "vendor": "vercel", "versions": [{"lessThan": "15.0.0", "status": "affected", "version": "15.0.0-canary.0", "versionType": "semver"}, {"lessThan": "15.0.1", "status": "affected", "version": "15.0.1-canary.0", "versionType": "semver"}, {"lessThan": "15.0.2", "status": "affected", "version": "15.0.2-canary.0", "versionType": "semver"}, {"lessThan": "15.0.3", "status": "affected", "version": "15.0.3-canary.0", "versionType": "semver"}, {"lessThan": "15.0.4", "status": "affected", "version": "15.0.4-canary.0", "versionType": "semver"}, {"lessThan": "15.1.0", "status": "affected", "version": "15.1.0-canary.0", "versionType": "semver"}, {"lessThan": "15.1.1", "status": "affected", "version": "15.1.1-canary.0", "versionType": "semver"}, {"lessThan": "15.1.2", "status": "affected", "version": "15.1.2-canary.0", "versionType": "semver"}, {"lessThan": "15.1.3", "status": "affected", "version": "15.1.3-canary.0", "versionType": "semver"}, {"lessThan": "15.1.4", "status": "affected", "version": "15.1.4-canary.0", "versionType": "semver"}, {"lessThan": "15.1.5", "status": "affected", "version": "15.1.5-canary.0", "versionType": "semver"}, {"lessThan": "15.1.6", "status": "affected", "version": "15.1.6-canary.0", "versionType": "semver"}, {"lessThan": "15.1.7", "status": "affected", "version": "15.1.7-canary.0", "versionType": "semver"}, {"lessThan": "15.2.0", "status": "affected", "version": "15.2.0-canary.0", "versionType": "semver"}, {"lessThan": "15.2.1", "status": "affected", "version": "15.2.1-canary.0", "versionType": "semver"}, {"lessThan": "15.2.2", "status": "affected", "version": "15.2.2-canary.0", "versionType": "semver"}, {"lessThan": "15.2.3", "status": "affected", "version": "15.2.3-canary.0", "versionType": "semver"}, {"lessThan": "15.2.4", "status": "affected", "version": "15.2.4-canary.0", "versionType": "semver"}, {"lessThan": "15.2.5", "status": "affected", "version": "15.2.5-canary.0", "versionType": "semver"}, {"lessThan": "15.3.0", "status": "affected", "version": "15.3.0-canary.0", "versionType": "semver"}, {"lessThan": "15.3.1", "status": "affected", "version": "15.3.1-canary.0", "versionType": "semver"}, {"lessThan": "15.3.2", "status": "affected", "version": "15.3.2-canary.0", "versionType": "semver"}, {"lessThan": "15.1.8", "status": "affected", "version": "15.1.8-canary.0", "versionType": "semver"}, {"lessThan": "15.3.3", "status": "affected", "version": "15.3.3-canary.0", "versionType": "semver"}, {"lessThan": "15.4.0", "status": "affected", "version": "15.4.0-canary.0", "versionType": "semver"}, {"lessThan": "15.3.4", "status": "affected", "version": "15.3.4-canary.0", "versionType": "semver"}, {"lessThan": "15.3.5", "status": "affected", "version": "15.3.5-canary.0", "versionType": "semver"}, {"lessThan": "15.4.1", "status": "affected", "version": "15.4.1-canary.0", "versionType": "semver"}, {"lessThan": "15.4.2", "status": "affected", "version": "15.4.2-canary.0", "versionType": "semver"}, {"lessThan": "15.4.3", "status": "affected", "version": "15.4.3-canary.0", "versionType": "semver"}, {"lessThan": "15.4.4", "status": "affected", "version": "15.4.4-canary.0", "versionType": "semver"}, {"lessThan": "15.4.5", "status": "affected", "version": "15.4.5-canary.0", "versionType": "semver"}, {"lessThan": "15.4.6", "status": "affected", "version": "15.4.6-canary.0", "versionType": "semver"}, {"lessThan": "15.4.7", "status": "affected", "version": "15.4.7-canary.0", "versionType": "semver"}, {"lessThan": "15.5.0", "status": "affected", "version": "15.5.0-canary.0", "versionType": "semver"}, {"lessThan": "15.5.1", "status": "affected", "version": "15.5.1-canary.0", "versionType": "semver"}, {"lessThan": "15.5.2", "status": "affected", "version": "15.5.2-canary.0", "versionType": "semver"}, {"lessThan": "15.5.3", "status": "affected", "version": "15.5.3-canary.0", "versionType": "semver"}, {"lessThan": "15.5.4", "status": "affected", "version": "15.5.4-canary.0", "versionType": "semver"}, {"lessThan": "15.5.5", "status": "affected", "version": "15.5.5-canary.0", "versionType": "semver"}, {"lessThan": "15.5.6", "status": "affected", "version": "15.5.6-canary.0", "versionType": "semver"}, {"lessThan": "15.5.7", "status": "affected", "version": "15.5.7-canary.0", "versionType": "semver"}, {"lessThan": "15.4.8", "status": "affected", "version": "15.4.8-canary.0", "versionType": "semver"}, {"lessThan": "15.1.9", "status": "affected", "version": "15.1.9-canary.0", "versionType": "semver"}, {"lessThan": "15.0.5", "status": "affected", "version": "15.0.5-canary.0", "versionType": "semver"}, {"lessThan": "15.3.6", "status": "affected", "version": "15.3.6-canary.0", "versionType": "semver"}, {"lessThan": "15.2.6", "status": "affected", "version": "15.2.6-canary.0", "versionType": "semver"}, {"lessThan": "15.5.8", "status": "affected", "version": "15.5.8-canary.0", "versionType": "semver"}, {"lessThan": "15.4.9", "status": "affected", "version": "15.4.9-canary.0", "versionType": "semver"}, {"lessThan": "15.3.7", "status": "affected", "version": "15.3.7-canary.0", "versionType": "semver"}, {"lessThan": "15.2.7", "status": "affected", "version": "15.2.7-canary.0", "versionType": "semver"}, {"lessThan": "15.1.10", "status": "affected", "version": "15.1.10-canary.0", "versionType": "semver"}, {"lessThan": "15.0.6", "status": "affected", "version": "15.0.6-canary.0", "versionType": "semver"}, {"lessThan": "15.5.9", "status": "affected", "version": "15.5.9-canary.0", "versionType": "semver"}, {"lessThan": "15.4.10", "status": "affected", "version": "15.4.10-canary.0", "versionType": "semver"}, {"lessThan": "15.3.8", "status": "affected", "version": "15.3.8-canary.0", "versionType": "semver"}, {"lessThan": "15.2.8", "status": "affected", "version": "15.2.8-canary.0", "versionType": "semver"}, {"lessThan": "15.1.11", "status": "affected", "version": "15.1.11-canary.0", "versionType": "semver"}, {"lessThan": "15.0.7", "status": "affected", "version": "15.0.7-canary.0", "versionType": "semver"}, {"lessThan": "16.1.5", "status": "affected", "version": "16.1.0", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "F606D5B4-9222-438C-9B5C-F3746700234A", "versionEndExcluding": "15.6.0", "versionStartIncluding": "15.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "4A242736-494D-4C26-AB21-188C2E2F39FF", "versionEndExcluding": "16.1.5", "versionStartIncluding": "16.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*", "matchCriteriaId": "3ED7F693-8012-4F88-BC71-CF108E20664A", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*", "matchCriteriaId": "40EE98AC-754A-4FD9-B51A-9E2674584FD9", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*", "matchCriteriaId": "13B41C54-AF21-4637-A852-F997635B4E83", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*", "matchCriteriaId": "91B41697-2D70-488D-A5C3-CB9D435560CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*", "matchCriteriaId": "7D43DB84-7BCF-429B-849A-7189EC1922D0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*", "matchCriteriaId": "CEC2346B-8DBD-4D53-9866-CFBDD3AACEF2", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*", "matchCriteriaId": "2BC95097-8CA6-42FE-98D7-F968E37C11B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*", "matchCriteriaId": "4F8FA85C-1200-4FD2-B5D7-906300748BD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*", "matchCriteriaId": "5D0B177B-2A31-48E9-81C7-1024E2452486", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:*", "matchCriteriaId": "7CCA01F3-3A14-4450-8A68-B1DA22C685B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:*", "matchCriteriaId": "1AB351AE-8C29-4E67-8699-0AAC6B3383E2", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:*", "matchCriteriaId": "14A34D9D-5FA2-434B-836E-3CE63D716CCB", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:*", "matchCriteriaId": "E8440F05-F32B-4D40-90B7-04BF22107D86", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:*", "matchCriteriaId": "FB6C6F6D-1EC0-4BD9-97A4-CFDE70DF0C43", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:*", "matchCriteriaId": "6189BD4C-A3E2-451B-96B2-FF01250E946D", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:*", "matchCriteriaId": "389EE453-8B07-45DD-BE9C-277C9C5CB156", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:*", "matchCriteriaId": "BA4D4638-4734-4B16-87AA-EF4B5D2DDD7A", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:*", "matchCriteriaId": "D54A2E63-6E0C-4E17-86A8-459B0A7EE00B", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:*", "matchCriteriaId": "E6136F0A-3010-4BAD-811B-D047CF5E6F64", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:*", "matchCriteriaId": "525EFA40-B14B-47E9-8FBD-45721A802DB6", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:*", "matchCriteriaId": "69142944-1EC0-4F94-862E-FA7F2E101101", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:*", "matchCriteriaId": "30016C06-372D-4F98-84A8-0732CA054970", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:*", "matchCriteriaId": "E1536E2B-84EC-46A3-9B6F-026364A9D927", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:*", "matchCriteriaId": "5E6F1F60-30E2-407C-8152-EEEB7EFE24CB", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:*", "matchCriteriaId": "3C907301-2C8F-465B-8134-94130E29F5DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:*", "matchCriteriaId": "E81C89FD-40CB-471E-9967-90ACDCF79373", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:*", "matchCriteriaId": "55E8AEEC-A686-49D6-B298-AEE4E838E769", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:*", "matchCriteriaId": "CB0618EC-6A0B-4AC3-BF6D-E51AC84C4E15", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:*", "matchCriteriaId": "7B27F133-8EB4-4761-A706-DF42D4EB55F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:*", "matchCriteriaId": "BF975472-B7E7-4AC8-B834-DA19897A4894", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:*", "matchCriteriaId": "48A82613-F3FD-4E89-8E4A-F3F05A616171", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:*", "matchCriteriaId": "0D42CA1F-7C21-47C1-8A9C-1015286FCBE2", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:*", "matchCriteriaId": "7C83A4EF-B96F-40EC-BA1F-FE1370AF78AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:*", "matchCriteriaId": "C151FDAB-DE34-4A7E-9762-6E99386798BF", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:*", "matchCriteriaId": "53025212-05F0-41FE-81F8-023B1784BB8C", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:*", "matchCriteriaId": "68EAC2B9-32A5-4721-BB35-16D519CD1BBC", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:*", "matchCriteriaId": "7411EF71-CBEB-4127-935F-3C732A1E22AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:*", "matchCriteriaId": "0C4B8930-1B65-4894-AFA8-C323AA7A8292", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:*", "matchCriteriaId": "B4977345-BD8C-41C7-9DD7-1E41D6CC6438", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:*", "matchCriteriaId": "EFE030A4-5B14-4C2D-B953-E80C98FB26EE", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:*", "matchCriteriaId": "9F616FD4-83BF-4A9A-AFFD-0D3E2544DC7E", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:*", "matchCriteriaId": "00512630-8B88-43B0-9ED3-2B33C64CC9A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:*", "matchCriteriaId": "A88EEF11-C7DA-4E2D-A030-FC177E696557", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:*", "matchCriteriaId": "BE8453D9-7275-4A5F-8732-F05662FFF2E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:*", "matchCriteriaId": "E306B896-9BBB-424B-8D99-7A1A79AEFE9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:*", "matchCriteriaId": "ACA87B86-33D5-4BEA-A13D-EEB4922D511E", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:*", "matchCriteriaId": "77AA0D23-B101-445C-A260-ED3152A93D17", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:*", "matchCriteriaId": "7D7DCCF7-FC83-4767-A0C2-C84A8B14F93B", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:*", "matchCriteriaId": "FD397568-7F1F-4153-AF08-B22D4D3B45F9", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:*", "matchCriteriaId": "984416EF-B121-40CE-B3AD-E22A06BB5844", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:*", "matchCriteriaId": "C4B58652-EE24-43CF-8ABE-4A01B2C9938C", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:*", "matchCriteriaId": "8090CF73-AEA7-43FC-A960-321BED3B1682", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:*", "matchCriteriaId": "823164E5-609D-4F24-86A5-E25618FE86A7", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:*", "matchCriteriaId": "E13CD688-63C3-4FFA-9D13-696005F0C155", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:*", "matchCriteriaId": "B397B18C-8A7A-4766-9A68-98B26E190A4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary58:*:*:*:node.js:*:*", "matchCriteriaId": "15454C74-5F28-475D-830A-2AE603292301", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:*", "matchCriteriaId": "A638BD4D-8CE5-421E-97C3-A56A4F057A50", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:*", "matchCriteriaId": "2DB345E3-BAD0-497E-93AE-5E4DC669C192", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary60:*:*:*:node.js:*:*", "matchCriteriaId": "A5214A75-B9EA-4A8A-B739-48FBC10C3B59", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:*", "matchCriteriaId": "840FEB19-2C66-4004-A488-B90219F8AC05", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:*", "matchCriteriaId": "C260F966-73D7-43F3-A329-8C558A695821", "vulnerable": true}, {"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:*", "matchCriteriaId": "28130A79-39B5-43E8-A690-C8E9C62483F8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:\n\n1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.\n\n2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.\n\nBoth attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.\n\nTo be affected you must have an application running with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.\n\nStrongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications."}, {"lang": "es", "value": "Una vulnerabilidad de denegaci\u00f3n de servicio existe en versiones de Next.js con Partial Prerendering (PPR) habilitado cuando se ejecuta en modo minimal. El endpoint de reanudaci\u00f3n de PPR acepta solicitudes POST no autenticadas con el encabezado 'Next-Resume: 1' y procesa datos de estado pospuestos controlados por el atacante. Dos vulnerabilidades estrechamente relacionadas permiten a un atacante bloquear el proceso del servidor a trav\u00e9s del agotamiento de la memoria:\n\n1. Almacenamiento en b\u00fafer ilimitado del cuerpo de la solicitud: El servidor almacena en b\u00fafer todo el cuerpo de la solicitud POST en la memoria usando 'Buffer.concat()' sin imponer ning\u00fan l\u00edmite de tama\u00f1o, permitiendo que cargas \u00fatiles arbitrariamente grandes agoten la memoria disponible.\n\n2. Descompresi\u00f3n ilimitada (zipbomb): La cach\u00e9 de datos de reanudaci\u00f3n se descomprime usando 'inflateSync()' sin limitar el tama\u00f1o de la salida descomprimida. Una peque\u00f1a carga \u00fatil comprimida puede expandirse a cientos de megabytes o gigabytes, causando agotamiento de la memoria.\n\nAmbos vectores de ataque resultan en un error fatal de V8 por falta de memoria ('FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory') lo que provoca la terminaci\u00f3n del proceso de Node.js. La variante zipbomb es particularmente peligrosa ya que puede eludir los l\u00edmites de tama\u00f1o de solicitud de los proxies inversos mientras sigue causando una gran asignaci\u00f3n de memoria en el servidor.\n\nPara verse afectado, debe tener una aplicaci\u00f3n ejecut\u00e1ndose con 'experimental.ppr: true' o 'cacheComponents: true' configurado junto con la variable de entorno NEXT_PRIVATE_MINIMAL_MODE=1.\n\nConsidere seriamente actualizar a 15.6.0-canary.61 o 16.1.5 para reducir el riesgo y prevenir problemas de disponibilidad en las aplicaciones Next."}], "id": "CVE-2025-59472", "lastModified": "2026-06-17T09:46:13.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "support@hackerone.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59472", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T14:52:42.677682Z", "version": "2.0.3"}}]}, "published": "2026-01-26T22:15:53.027", "references": [{"source": "support@hackerone.com", "tags": ["Vendor Advisory"], "url": "https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "next: NextJS Denial of Service in Partial Pre Rendering", "id": "2433092", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433092"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:\n1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.\n2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.\nBoth attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.\nTo be affected you must have an application running with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.\nStrongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-59472", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "dotnet7.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/disk-image-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Fix deferred", "package_name": "rhtas/rekor-search-ui-rhel9", "product_name": "Red Hat Trusted Artifact Signer"}, {"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Fix deferred", "package_name": "com.github.streamshub-console", "product_name": "streams for Apache Kafka 2"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Fix deferred", "package_name": "com.github.streamshub-console", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-01-26T21:43:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-59472\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59472\nhttps://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h"], "threat_severity": "Moderate"}

{"created": "2026-01-27T09:03:27.865230+00:00", "updated": "2026-01-27T09:03:27.865256+00:00", "vendors": ["vercel", "vercel$PRODUCT$next.js"]}