CVE-2026-27979: Next.js Unbounded Postponed Resume Buffering Leads to DoS
Summary
CVE-2026-27979: Next.js: Unbounded postponed resume buffering can lead to DoS. Affects next versions >= 16.0.1, < 16.1.7. Fixed in 16.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular React framework that enables developers to build server-rendered applications with ease. It offers features like static site generation, server-side rendering, and API routes, making it a versatile choice for modern web development. However, certain configurations, particularly those involving the App Router and Partial Prerendering, have introduced vulnerabilities that can be exploited if not properly managed.
Vulnerability Detail
The vulnerability arises from the handling of requests with the 'next-resume: 1' header, which corresponds to a PPR resume request. In specific setups, this header allows oversized POST payloads to be buffered without enforcing the 'maxPostponedStateSize' limit consistently. This oversight can lead to excessive memory consumption, potentially resulting in a denial of service (DoS) for applications using the App Router with Partial Prerendering enabled.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
16.1.7
This is the first release that contains the fix.
npm install next@16.1.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade immediately, you can block requests containing the 'next-resume' header. This can be done by adding middleware to your application that checks for this header and rejects any requests that include it. Example code snippet:
const express = require('express');
const app = express();
app.use((req, res, next) => {
if (req.headers['next-resume']) {
return res.status(400).send('Invalid request');
}
next();
});
Conclusion
The vulnerability identified as CVE-2026-27979 in Next.js can lead to denial of service due to unbounded postponed resume buffering. It is crucial to update to the patched version or implement the recommended workarounds to mitigate potential risks.
See every vulnerability recorded for next →
FAQ
The CVSS score of this vulnerability is 6.9, indicating a moderate level of risk.
Versions of Next.js prior to 16.1.7 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
If an immediate upgrade is not possible, implement the workaround by blocking requests with the 'next-resume' header.
The 'next-resume' header is used in PPR resume requests, and its misuse can lead to unbounded memory consumption if not properly managed.
References
Related vulnerabilities
Recent vulnerabilities recorded for next.
