CVE-2024-39693 HIGH

CVE-2024-39693: Next.js Denial of Service (DoS) condition

Vendor Vercel

Product next.js

Weakness CWE-400

Published July 10, 2024

Last update November 5, 2024

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. his vulnerability was resolved in Next.js 13.5 and later.

Key dates

02Disclosure timeline

July 10, 2024 CVE published

November 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-39693 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/400.html

Related vulnerabilities

04Related CVE

CVE-2023-47150 IBM Common Cryptographic Architecture denial of service CVE-2022-21653 Hash collision in typelevel jawn CVE-2025-48795 Apache CXF: Denial of Service and sensitive data exposure in logs CVE-2024-58306 minaliC 2.0.0 Denial of Service Vulnerability via Large GET Request CVE-2026-44240 basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering