A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion: 1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory. 2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion. Both attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server. To be affected you must have an application running with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable. Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.

The Next.js Framework on the remote host is affected by a denial of service vulnerability:

  - A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when     running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1     header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an     attacker to crash the server process through memory exhaustion: unbounded request body buffering where the     server buffers the entire POST request body into memory using Buffer.concat() without enforcing any size limit,     and unbounded decompression (zipbomb) where the resume data cache is decompressed using inflateSync() without     limiting the decompressed output size. Both attack vectors result in a fatal V8 out-of-memory error causing     the Node.js process to terminate. (CVE-2025-59472)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when
    running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-
    Resume: 1` header and processes attacker-controlled postponed state data. Two closely related
    vulnerabilities allow an attacker to crash the server process through memory exhaustion: 1. **Unbounded
    request body buffering**: The server buffers the entire POST request body into memory using
    `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust
    available memory. 2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using
    `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to
    hundreds of megabytes or gigabytes, causing memory exhaustion. Both attack vectors result in a fatal V8
    out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`)
    causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass
    reverse proxy request size limits while still causing large memory allocation on the server. To be
    affected you must have an application running with `experimental.ppr: true` or `cacheComponents: true`
    configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable. Strongly consider upgrading to
    15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
    (CVE-2025-59472)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when     running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-     Resume: 1` header and processes attacker-controlled postponed state data. Two closely related     vulnerabilities allow an attacker to crash the server process through memory exhaustion: 1. **Unbounded     request body buffering**: The server buffers the entire POST request body into memory using     `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust     available memory. 2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using     `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to     hundreds of megabytes or gigabytes, causing memory exhaustion. Both attack vectors result in a fatal V8     out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`)     causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass     reverse proxy request size limits while still causing large memory allocation on the server. To be     affected you must have an application running with `experimental.ppr: true` or `cacheComponents: true`     configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable. Strongly consider upgrading to     15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
    (CVE-2025-59472)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
297815	Next.js Framework 15.x < 15.6.0-canary.61 / 16.x < 16.1.5 PPR Resume Endpoint DoS (GHSA-5f7q-jpqc-wp7h)	Nessus	Misc.	Local	high
437343	SCA: security update for next (GHSA-5f7q-jpqc-wp7h)	Tenable Cloud Security	SCA Checks	Local	high
437343	SCA: security update for next (GHSA-5f7q-jpqc-wp7h)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
297048	Linux Distros Unpatched Vulnerability : CVE-2025-59472	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2025-59472

high

Tenable Plugins

high

high

high

high