Next.js Allows a Denial of Service (DoS) with Server Actions

The primary impact of CVE-2024-56332 is a denial of service. An attacker can repeatedly trigger Server Actions with requests designed to hang indefinitely, effectively preventing legitimate users from accessing those actions. While the Next.js server itself has a low CPU and memory footprint during this hanging state, the prolonged connection can still exhaust hosting provider resources and lead to service disruption. This is analogous to a resource exhaustion attack, where the attacker aims to overwhelm the system's capacity to handle requests. Deployments without protection against long-running Server Action invocations are particularly vulnerable, as hosting providers often impose limits on function execution duration to prevent excessive billing and abuse.

Applications utilizing Next.js Server Actions, particularly those deployed on shared hosting platforms like Vercel or Netlify, are at increased risk. Organizations relying on Server Actions for critical functionality or those with inadequate monitoring and alerting mechanisms are also more vulnerable.

• nodejs / server: Monitor Server Action execution times using application performance monitoring (APM) tools. Set alerts for actions exceeding a predefined threshold.

# Example: Using Node.js built-in process.hrtime to measure execution time
const start = process.hrtime();
// ... Server Action logic ...
const end = process.hrtime(start);
const executionTimeInSeconds = end[0] + end[1] / 1e9;
if (executionTimeInSeconds > 5) {
  console.warn('Server Action exceeded timeout');
}

• nodejs / server: Review application logs for unusual patterns of Server Action invocations, such as a high volume of requests from a single IP address or user. • nodejs / server: Implement rate limiting on Server Actions to restrict the number of requests from a single source within a given timeframe.

1. 2025-01-03Disclosure

   disclosure

1. 已保留2024-12-19
2. 发布日期2025-01-03
3. 修改日期2026-02-04
4. EPSS 更新日期2026-04-02

The recommended mitigation for CVE-2024-56332 is to upgrade to Next.js version 13.5.8 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing rate limiting or request timeouts on Server Actions to prevent malicious actors from triggering excessive or prolonged requests. Additionally, review your hosting provider's documentation regarding function execution limits and ensure your deployments are configured to adhere to those limits. Monitoring Server Action execution times can also help identify and mitigate potential DoS attacks.

最后更新

16.2.6最近