CVE-2024-56332

Summary

CVE-2024-56332 is a newly identified Denial of Service (DoS) vulnerability affecting versions 13.0.0 to 13.5.7, 14.2.20, and 15.1.1 of Next.js, a popular React framework for building full-stack web applications. This vulnerability allows attackers to construct malicious requests, causing Server Actions to hang indefinitely, resulting in excessive resource consumption and potential DoS or Denial of Wallet (DoW) attacks. Deployments without proper mitigations against long-running Server Action invocations, such as those offered by hosting providers like Vercel or Netlify, are particularly susceptible. Users are recommended to upgrade to Next.js versions 13.5.8, 14.2.21, and 15.1.2 as soon as possible to mitigate this risk. No official workarounds have been provided by the vendor.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.