CVE-2026-27979

score

<0.1

cvss

7.5

epss

0.9%

published

2026-03-18

kev added

—

first seen

2026-10-21

Next.js >= 16.0.1 and < 16.1.7 contains a denial of service vulnerability caused by unbounded postponed resume-body buffering when processing requests with the 'next-resume: 1' header in non-minimal deployments, letting attackers cause excessive memory usage, exploit requires sending crafted POST requests with the header.