CVE-2025-59472
1 advisory.
npm/next CVE-2025-59472: medium 5.9, EPSS 0.43%
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
Action: Upgrade next to 15.6.0-canary.61 or later.
npm i next@16.1.5npm i next@15.6.0-canary.61Affected
| introduced | fixed | last affected |
|---|---|---|
| 16.0.0-beta.0 | 16.1.5 | - |
| 15.0.0-canary.0 | - | 15.0.0-canary.205 |
| 15.0.1-canary.0 | - | 15.0.1-canary.3 |
| 15.0.2-canary.0 | - | 15.0.2-canary.11 |
| 15.0.3-canary.0 | - | 15.0.3-canary.9 |
| 15.0.4-canary.0 | - | 15.0.4-canary.52 |
| 15.1.1-canary.0 | - | 15.1.1-canary.27 |
| 15.2.0-canary.0 | - | 15.2.0-canary.77 |
| 15.2.1-canary.0 | - | 15.2.1-canary.6 |
| 15.2.2-canary.0 | - | 15.2.2-canary.7 |
| 15.3.0-canary.0 | - | 15.3.0-canary.46 |
| 15.3.1-canary.0 | - | 15.3.1-canary.15 |
| 15.4.0-canary.0 | - | 15.4.0-canary.130 |
| 15.4.2-canary.0 | - | 15.4.2-canary.56 |
| 15.5.1-canary.0 | - | 15.5.1-canary.39 |
| 15.6.0-canary.0 | 15.6.0-canary.61 | - |
Fixed versions
| 16.1.5 | 15.6.0-canary.61 |
Sources
- osv: GHSA-5f7q-jpqc-wp7h
- https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h
- https://nvd.nist.gov/vuln/detail/CVE-2025-59472
- https://github.com/vercel/next.js
- https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
CVE-2025-59472 · published · modified · JSON