### Impact
A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server.

**This vulnerability can affect all Next.js deployments on the affected versions.**

### Patches
This vulnerability was resolved in Next.js 13.5 and later. We recommend that users upgrade to a safe version.

### Workarounds
There are no official workarounds for this vulnerability.

#### Credit
* Thai Vu of [flyseccorp.com](http://flyseccorp.com/)
* Aonan Guan (@0dd), Senior Cloud Security Engineer

Affected Packages

npm next

Affected versions: 13.3.1 (fixed in 13.5.0)

Related CVEs

CVE-2024-39693

Key Information

GHSA ID

GHSA-fq54-2j52-jc42

Published

July 10, 2024 4:03 PM

Last Modified

November 6, 2024 2:30 PM

CVSS Score

7.5 /10

Primary Ecosystem

npm

Primary Package

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 6, 2025 6:30 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.