Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseGHSA-fjv4-77jr-mrxm
GHSA-fjv4-77jr-mrxm:
JavaScript vulnerability analysis and mitigation
Summary
next-resume is an internal Next.js header used to resume a partially prerendered (PPR) render: when it is set on a POST request, the request body is read as the postponed state of the render.
Next.js strips this header from untrusted incoming requests since 15.5.16 / 16.2.5 (GHSA-mg66-mrh9-m8jx). OpenNext does not use the Next.js router server, which performs this filtering, and maintains its own list of internal headers to strip in core/routingHandler.ts (NEXT_INTERNAL_HEADERS). That list was copied from an older Next.js version and does not include next-resume, so the header sent by the client reaches Next.js.
Details
Where Next.js honors next-resume:
| Next.js | base-server.js | App Router page handler |
|---|---|---|
| 15.x, 16.0.x | minimal mode only | not handled |
| >= 16.1.0 | minimal mode only | cacheComponents enabled, regardless of minimal mode (build/templates/app-page.js, app-page-runtime.js since 16.3) |
OpenNext does not run Next.js in minimal mode. Only applications using Next.js >= 16.1 with cacheComponents enabled are affected. | ||
For those applications, a POST request with next-resume: 1 to an App Router page makes the page handler read the request body as the postponed state, which is the condition fixed by Next.js in GHSA-mg66-mrh9-m8jx (request-body handling deadlock when combined with a server action, leading to connection exhaustion). |
Impact
Applications using Next.js >= 16.1 with cacheComponents enabled are exposed to the denial of service described in GHSA-mg66-mrh9-m8jx: crafted POST requests can keep requests open until they time out, consuming server capacity (for example concurrent Lambda executions).
Applications using Next.js 15.x or 16.0.x, or not enabling cacheComponents, are not affected.
Workarounds
Until you upgrade, strip or block requests containing the next-resume header at the CDN or proxy in front of OpenNext, for example with a CloudFront function or a Cloudflare WAF / Transform Rule. Make sure OpenNext cannot be reached through an endpoint that bypasses that rule, for example a Lambda Function URL or the default API Gateway endpoint.
Source: NVD
