A high-severity excessive iteration vulnerability in Next.js allows unauthenticated attackers to trigger a Denial of Service by consuming excessive system resources.

The software is susceptible to CWE-834 (Excessive Iteration), which allows unauthenticated remote attackers to cause resource exhaustion. This occurs when specific inputs force the application to perform redundant or infinite processing loops.

Exploitation of this vulnerability can result in significant application downtime, impacting business operations and availability for legitimate users. With a CVSS score of 8.2, this vulnerability represents a high risk to service continuity, requiring immediate attention to prevent potential service disruption.

Immediate Action: Update the Next.js framework to version 15.5.21 or 16.2.11 to resolve the excessive iteration flaw.

Proactive Monitoring: Monitor server CPU and memory utilization for sudden, unexplained spikes that may indicate an attempt to trigger resource-intensive loops.

Compensating Controls: Implement rate limiting and request timeouts at the edge or load balancer level to mitigate the impact of resource exhaustion attacks.

Public Exploit Available: No

Given the potential for service degradation, this update should be integrated into the next maintenance cycle or deployed immediately if the application is internet-facing and high-traffic. Patching is the only definitive way to resolve the underlying resource management defect.