CVE-2026-27979

Description

Next.js: Unbounded postponed resume buffering can lead to DoS

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• https://github.com/vercel/next.js/security/advisories/GHSA-h27x-g6w4-24gq
• https://nvd.nist.gov/vuln/detail/CVE-2026-27979
• https://github.com/vercel/next.js/commit/c885d4825f800dd1e49ead37274dcd08cdd6f3f1
• https://github.com/vercel/next.js
• https://github.com/vercel/next.js/releases/tag/v16.1.7