All vulnerabilities

npm

CVE-2024-56332

Next.js Allows a Denial of Service (DoS) with Server Actions

Severity: Medium 5.3
Published: 3 Jan 2025
Last changed: 10 Sept 2026
Added to UpHeron: 14 Oct 2026
Fixed in: 13.5.8, 14.2.21, 15.1.2
Also known as: GHSA-7m27-7ghc-44w9
Sources: OSV.dev and GitHub

Affected software

Software	Affected versions
Next.jsnpm · `osv:npm:next`	From 13.0.0 before 13.5.8 From 14.0.0 before 14.2.21 From 15.0.0 before 15.1.2

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2024-56332
GitHub Advisory Database https://github.com/advisories/GHSA-7m27-7ghc-44w9