GHSA-5j59-xgg2-r9c4

What it actually does

An incomplete follow-up fix in Next.js Server Components still allows specially crafted React Server Components (Flight) protocol requests to drive unbounded work in the server request path. That can pin the Node.js event loop, exhaust CPU or memory, hang or crash worker processes, and deny service. Confidentiality and integrity are not affected; the impact is availability-only.

Why it matters to the business

Unauthenticated requests can take customer-facing Next.js applications offline, causing failed checkouts, broken APIs, SLA breaches, and emergency restarts. The issue is not in CISA KEV, is not tied to ransomware campaigns, and has no reported exploit maturity, but CVSS 7.5 (High) availability impact remains. It has been public for about 291 days, so unpatched App Router estates represent avoidable residual outage risk rather than a brand-new emergency.

How an attack unfolds

An unauthenticated attacker finds a Next.js app using the App Router and Server Components, typically via /_next/ assets or RSC-related response behavior. They send HTTP requests whose Server Components / Flight protocol content still hits the incompletely patched handling path. The server then performs costly or blocking work, workers stop serving legitimate traffic, and repeating the requests extends the outage until processes are recycled or the application is upgraded. No account or special privilege is required.

How to fix it

Upgrade the next package to the patched releases named in GitHub advisory GHSA-5j59-xgg2-r9c4 (the Server Components DoS incomplete-fix follow-up). Do not treat earlier Server Components DoS patches as sufficient. Rebuild and redeploy every app image, serverless function, and container so lockfiles and node_modules pick up the fixed next version. Until upgraded, rate-limit and cap body size on RSC-related POST routes, enable aggressive health checks and auto-restart of hung Node workers, and place WAF controls on Server Components request patterns. Kernel package bumps do not remediate this application-layer issue.

How to confirm the fix worked

Inventory running Next.js versions and lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) and confirm next matches a patched advisory release. After deploy, verify instances no longer hang under RSC-related request load in a controlled staging check using vendor guidance, and confirm production health checks, event-loop delay, and memory stay stable. Search images and SBOMs for unpatched next versions still shipped in older layers.

Typical attack path

1. Discover internet-reachable Next.js applications that use App Router / Server Components
2. Send unauthenticated HTTP requests that exercise the Server Components (Flight) protocol on application routes
3. Detect hangs, 5xx responses, worker crashes, or CPU/memory saturation indicating the incomplete DoS path was hit
4. Repeat or automate those requests to keep workers exhausted and prolong the outage

How to detect it

Hunt web, reverse-proxy, CDN, and WAF logs around unexplained latency, 502/503/504 spikes, or Next.js process restarts. Correlate bursts of POST traffic carrying React Server Components indicators with Node CPU saturation, event-loop delay, or OOMKilled containers. Review application logs for exceptions in Flight/RSC deserialization or render handling and orchestrator events for repeated next-server restarts. No named threat actors or KEV exploitation are associated with this issue; treat coinciding RSC request floods and worker exhaustion as the primary already-exploited signal.

• Next-Action:
• RSC: 1
• text/x-component
• $ACTION_ID_
• $ACTION_REF_
• next-server
• /_next/

What your security team should do

• Immediately inventory Next.js App Router deployments and upgrade next to GHSA-5j59-xgg2-r9c4 patched versions; rebuild all artifacts
• Do not assume prior Server Components DoS fixes closed this follow-up
• Add rate limits, request-body limits, and WAF rules on RSC/Flight request paths as compensating controls
• Alert on Node worker CPU, event-loop lag, OOM kills, and 502/503/504 bursts on Next.js services
• Block promotion of images whose SBOM or lockfile still pins a vulnerable next version