CVE-2024-56332

描述

### Impact A Denial of Service (DoS) attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. _Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time._ Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing. This is the same issue as if the incoming HTTP request has an invalid `Content-Length` header or never closes. If the host has no other mitigations to those then this vulnerability is novel. This vulnerability affects only Next.js deployments using Server Actions. ### Patches This vulnerability was resolved in Next.js 14.2.21, 15.1.2, and 13.5.8. We recommend that users upgrade to a safe version. ### Workarounds There are no official workarounds for this vulnerability. ### Credits Thanks to the PackDraw team for responsibly disclosing this vulnerability.

如何修補 CVE-2024-56332

要修補 CVE-2024-56332,請將受影響套件升級到下列已修補版本。

• —升級至 13.5.8 或更新版本

CVE-2024-56332 正在被利用嗎?

低 — EPSS 為 0.8%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 13.0.0, < 13.5.8

CVSS 分數