An unauthenticated attacker can trigger a denial of service in Vercel Next.js applications by sending oversized next-resume requests that exhaust system memory.

This vulnerability is caused by improper resource management (CWE-770) where the application fails to enforce maxPostponedStateSize for next-resume headers in non-minimal deployments. This allows unauthenticated remote attackers to send malicious POST payloads that cause the server to buffer data without limits, leading to memory exhaustion.

The exploitation of this vulnerability can result in significant service instability or complete system downtime. Given the CVSS score of 7.5, the risk is classified as High due to the ease of exploitation and the potential for disruption of critical web services, which may lead to financial loss and negative impact on user experience.

Immediate Action: Upgrade to Next.js version 16.1.7 or later to ensure size limits are properly enforced across all buffering paths.

Proactive Monitoring: Monitor server memory utilization and identify unusual spikes in POST requests containing the next-resume header.

Compensating Controls: If an immediate update is not feasible, implement a WAF rule or middleware to block all requests containing the next-resume header, as this header is not intended for use by untrusted clients.

Public Exploit Available: No

The vulnerability presents a clear risk to availability for any Next.js application utilizing the App Router with Partial Prerendering enabled. Administrators must prioritize updating to version 16.1.7 immediately to patch the resource allocation logic. If patching must be delayed, the recommended workaround of blocking the next-resume header is highly effective and should be implemented as a temporary defense.