CVE-2024-56332 Next.js Vulnerable to Denial of Service (DoS) with Server Actions
Attackers can cause Denial of Service or Denial of Wallet by hanging Server Actions in Next.js deployments lacking execution time limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-56332?
CVE-2024-56332 is a medium-severity denial of service vulnerability in Vercel Next.js, published on 3 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. This vulnerability can also be used as a Denial of Wallet (DoW) attack when deployed in providers billing by response times. (Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.). Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing. This is the same issue as if the incoming HTTP request has an invalid `Content-Length` header or never closes. If the host has no other mitigations to those then this vulnerability is novel. This vulnerability affects only Next.js deployments using Server Actions. The issue was resolved in Next.js 13.5.8, 14.2.21, and 15.1.2. We recommend that users upgrade to a safe version. There are no official workarounds.
Weakness: CWE-770
Which versions are affected by CVE-2024-56332?
6 open source packages ship an affected version, including next. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 13.0.0 | 13.5.8 |
next npm | From 13.0.0 | 13.5.8 |
next npm | From 14.0.0 | 14.2.21 |
next npm | From 14.0.0 | 14.2.21 |
next npm | From 15.0.0 | 15.1.2 |
next npm | From 15.0.0 | 15.1.2 |
Products include Vercel Next.js.
How do I fix CVE-2024-56332?
Upgrade next to a fixed version for your release line: 13.5.8, 14.2.21 or 15.1.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-56332 being exploited?
There is no known exploitation of CVE-2024-56332 in the wild and no public exploit code.
Other vulnerabilities in Vercel Next.js
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Sources
Also known as GHSA-7m27-7ghc-44w9, MINI-jhc3-gcgr-6vq4, ROOT-APP-NPM-CVE-2024-56332.