Next.js fixed a high-severity DoS in App Router apps using Server Actions, where crafted requests can consume CPU and block other requests; Pages Router apps are unaffected
- Event type
- Security patch
Vulnerabilities that let attackers disrupt a service or exhaust its resources.
Next.js fixed a high-severity DoS in App Router apps using Server Actions, where crafted requests can consume CPU and block other requests; Pages Router apps are unaffected
A high-severity Zod DoS flaw (CVE-2023-54404) can exhaust memory during collection validation; version 4.6.6 protects size-bounded schemas, but v3 and unbounded collections remain exposed