CVE-2024-56332 | Next.js Vulnerable to Denial of Service (DoS) with Server Actions

Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. This vulnerability can also be used as a Denial of Wallet (DoW) attack when deployed in providers billing by response times. (Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.). Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing. This is the same issue as if the incoming HTTP request has an invalid `Content-Length` header or never closes. If the host has no other mitigations to those then this vulnerability is novel. This vulnerability affects only Next.js deployments using Server Actions. The issue was resolved in Next.js 13.5.8, 14.2.21, and 15.1.2. We recommend that users upgrade to a safe version. There are no official workarounds.

Published: 2025-01-03 Last update: 2025-09-10 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2024-56332 is rated Low Risk (39.6/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 0.79%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2024-56332

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.42% 0.79% +0.37%
2 2026-05-02 0.34% 0.42% +0.09%
3 2026-03-04 0.34%

Full EPSS history (30 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2024-56332

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.3 3.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:L)
Might cause slowdowns, glitches, or partial disruption—not a full brick.
3.9 1.4 [email protected]

Weakness enumeration for CVE-2024-56332

GitHub Security Advisory for CVE-2024-56332

GHSA-7m27-7ghc-44w9 · Severity: medium · Ecosystem: npm — Next.js Allows a Denial of Service (DoS) with Server Actions

OS Trackers for CVE-2024-56332

vendor priority summary link
redhat medium https://access.redhat.com/security/cve/CVE-2024-56332

Affected software / configurations for CVE-2024-56332

Vendor Product Version Raw CPE
vercel next.js >= 13.0.0, < 13.5.8 cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*
vercel next.js >= 14.0.0, < 14.2.21 cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*
vercel next.js >= 15.0.0, < 15.1.2 cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*

References for CVE-2024-56332

cvelogic Threat Intelligence