Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

• CVE-2025-59472: 0.43% estimated exploitation activity in the next 30 days; percentile 36.97 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion: 1. Unbounded request body buffering: The server buffers the entire POST request body into memory using Buffer.concat() without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory. 2. Unbounded decompression (zipbomb): The resume data cache is decompressed using inflateSync() without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion. Both attack vectors result in a fatal V8 out-of-memory error (FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory)…

Published by the source

28 Jan 2026, 15:20 UTC

Last modified by the source

10 Sep 2026, 03:50 UTC

Source last checked

26 Oct 2026, 12:47 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-5f7q-jpqc-wp7h

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-5f7q-jpqc-wp7h

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2025-59472

Advisory: Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
IDs: CVE-2025-59472, GHSA-5f7q-jpqc-wp7h
Record: https://patchnext.com/advisories/cve-2025-59472 (revision 2, source checked 26 Oct 2026, 12:47 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.9)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Partial vendor fix; fixed versions by package: next 16.1.5, 15.6.0-canary.61. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm next: affected >= 16.0.0-beta.0, < 16.1.5; >= 15.6.0-canary.0, < 15.6.0-canary.61; >= 15.0.0-canary.0, <= 15.0.0-canary.205; >= 15.0.1-canary.0, <= 15.0.1-canary.3; >= 15.0.2-canary.0, <= 15.0.2-canary.11; >= 15.0.3-canary.0, <= 15.0.3-canary.9; >= 15.0.4-canary.0, <= 15.0.4-canary.52; >= 15.1.1-canary.0, <= 15.1.1-canary.27; >= 15.2.0-canary.0, <= 15.2.0-canary.77; >= 15.2.1-canary.0, <= 15.2.1-canary.6; >= 15.2.2-canary.0, <= 15.2.2-canary.7; >= 15.3.0-canary.0, <= 15.3.0-canary.46; >= 15.3.1-canary.0, <= 15.3.1-canary.15; >= 15.4.0-canary.0, <= 15.4.0-canary.130; >= 15.4.2-canary.0, <= 15.4.2-canary.56; >= 15.5.1-canary.0, <= 15.5.1-canary.39; fixed in 16.1.5, 15.6.0-canary.61

## Suggested inspection (read-only)
- `npm ls next --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on next.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-5f7q-jpqc-wp7h (OSV record GHSA-5f7q-jpqc-wp7h lists affected ranges: npm next >=16.0.0-beta.0 =15.0.0-canary.0 =15.0.1-canary.0 =15.0.2-canary.0 =15.0.3-canary.0 =15.0.4-canary.0 =15.1.1-canary.0 =15.2.0-canary.0 =15.2.1-canary.0 =15.2.2-canary.0 =15.3.0-canary.0 =15.3.1-canary.0…)
- Verified: https://github.com/advisories/GHSA-5f7q-jpqc-wp7h (GitHub-reviewed advisory GHSA-5f7q-jpqc-wp7h lists affected ranges: npm next >=16.0.0-beta.0 =15.6.0-canary.0 =15.0.0-canary.0 =15.0.1-canary.0 =15.0.2-canary.0 =15.0.3-canary.0 =15.0.4-canary.0 =15.1.1-canary.0 =15.2.0-canary.0 =15.2.1-canary.0 =15.2.2-canary.0 =15.3.0-canary.0…)

Commands are suggestions: review each one before running it.