Allocation of Resources Without Limits or Throttling Affecting next package, versions >=13.0.0 <15.5.21>=16.0.0 <16.2.11

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the areAllActionIdsValid validation in server action form submission handling. An attacker can exhaust CPU and block other requests in the same process by sending a crafted form payload with many $ACTION_REF_ fields to a page that uses Server Actions. The vulnerable code processes these malformed MPA form submissions before deeper action decoding work, so repeated oversized action-reference fields force excessive validation work on the server. Applications using the App Router with at least one Server Action are affected; Pages Router apps and apps without Server Actions are not.

Notes

• The vulnerable path is in App Router’s MPA form-submission validation, so the expensive validation work is exercised before action decoding on requests carrying server-action form data rather than during the action handler itself.
• The malformed payload pattern is specific to repeated $ACTION_REF_ fields in the form body; ordinary Server Action submissions are not affected unless they include an unusually large number of those reference fields.

• GitHub Commit
• GitHub PR
• Maintainer's Advisory