CVE-2026-44579

7.5 high exploit SSVC exploitation: none Modified

Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.

Fix

Public exploits 1

iamfarzad/fbcounsulting_v2 PoC on GitHub

Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.

Patch, vendor advisory and mitigation references on NVD 1

https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx Mitigation, Vendor Advisory

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

CVE-2026-44579

Fix

Public exploits 1

Patch, vendor advisory and mitigation references on NVD 1

Change history 1

Affected (CPE criteria) 1

References 8