Next.js Vulnerability Generating Unbounded Traffic Processing Flows

EXECUTIVE SUMMARY:

A denial-of-service vulnerability CVE-2025-59472 affects Next.js where the Partial Prerendering (PPR) resume endpoint, when running in minimal mode with certain configurations enabled, does not enforce limits on internal resource consumption, allowing unauthenticated attackers to trigger unbounded memory allocation via specially crafted HTTP POST requests; such unbounded request body buffering and decompression can exhaust available memory, crash the server process, and render affected applications unavailable if they are using vulnerable Next.js versions. The vulnerability has a CVSS score of 5.9.