Vulnerability Report

CVE-2026-44579

Title: Next.js Partial Prerendering Connection Exhaustion DoS

XSS

Proof Of Concept

PoC Available for CVE-2026-44579

CWE Category CWE-770

Published Date May 13, 2026

Modified Date Jul 15, 2026

Exploit Status Available

Score 7.5 CVSS v3.1

Exploit Probability (EPSS)

0.71%

Vulnerability Summary

CVE-2026-44579: Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.

Impacted Vendors

vercel 1

kanopi 1

Reference Links

https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx

CVSS v3.1

Source Entity [email protected]

Severity HIGH

7.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1

Source Entity 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Severity HIGH

7.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-44579 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/iamfarzad/fbconsulting_v0_chat

View Code

GitHub https://github.com/iamfarzad/fbcounsulting_v2

View Code

July 15, 2026 MODIFIED