{"id":"CVE-2024-39693","aliases":["EUVD-2024-2338","GHSA-fq54-2j52-jc42","ROOT-APP-NPM-CVE-2024-39693"],"status":"published","title":"Next.js Denial of Service (DoS) condition","description":"Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. his vulnerability was resolved in Next.js 13.5 and later.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00494,"percentile":0.42773,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2024-07-10T16:03:06Z","modified":"2026-10-28T02:30:44Z","fixes":[{"ecosystem":"npm","package":"next","fixed_in":["13.5.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"next","fixed_in":["13.4.19-aikido.6","13.4.19-aikido.7","13.4.19-aikido.2","13.4.19-aikido.3","13.4.19-aikido.4","13.4.19-aikido.5"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/next","fixed_in":["13.4.19-root.io.6","13.4.19-root.io.7","13.4.19-root.io.2","13.4.19-root.io.3","13.4.19-root.io.4","13.4.19-root.io.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.1"},{"fixed":"13.5.0"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"13.3.1"},{"fixed":"13.5.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.4.19-aikido.6"},{"fixed":"13.4.19-aikido.7"},{"fixed":"13.4.19-aikido.2"},{"fixed":"13.4.19-aikido.3"},{"fixed":"13.4.19-aikido.4"},{"fixed":"13.4.19-aikido.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.4.19-root.io.6"},{"fixed":"13.4.19-root.io.7"},{"fixed":"13.4.19-root.io.2"},{"fixed":"13.4.19-root.io.3"},{"fixed":"13.4.19-root.io.4"},{"fixed":"13.4.19-root.io.5"}]}]}],"products":[{"vendor":"vercel","product":"next.js"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-fq54-2j52-jc42","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39693","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fq54-2j52-jc42"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39693.json","tags":["advisory"]},{"url":"https://github.com/vercel/next.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-39693","title":"Next.js Denial of Service (DoS) condition","description":"Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. his vulnerability was resolved in Next.js 13.5 and later.","status":"published","published":"2024-07-10T19:54:10.773Z","modified":"2024-11-05T14:40:42.493Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:19.28149Z"}],"euvd":[{"id":"EUVD-2024-2338","description":"Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. his vulnerability was resolved in Next.js 13.5 and later.","status":"published","published":"2024-07-10T19:54:10Z","modified":"2024-11-05T14:40:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:05:11.298723Z"}],"ghsa":[{"id":"GHSA-fq54-2j52-jc42","title":"Next.js Denial of Service (DoS) condition","description":"### Impact\nA Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server.\n\n**This vulnerability can affect all Next.js deployments on the affected versions.**\n\n### Patches\nThis vulnerability was resolved in Next.js 13.5 and later. We recommend that users upgrade to a safe version.\n\n### Workarounds\nThere are no official workarounds for this vulnerability.\n\n#### Credit\n* Thai Vu of [flyseccorp.com](http://flyseccorp.com/)\n* Aonan Guan (@0dd), Senior Cloud Security Engineer","status":"published","published":"2024-07-10T16:03:06Z","modified":"2024-11-06T14:30:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:16.477822Z"}],"nvd":[{"id":"CVE-2024-39693","description":"Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. his vulnerability was resolved in Next.js 13.5 and later.","status":"published","published":"2024-07-10T20:15:04.543Z","modified":"2026-06-17T07:42:28.997Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:10:12.016585Z"}],"osv":[{"id":"CVE-2024-39693","title":"Next.js Denial of Service (DoS) condition","description":"Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. his vulnerability was resolved in Next.js 13.5 and later.","status":"published","published":"2024-07-10T19:54:10.773Z","modified":"2026-10-28T02:30:44.887156454Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"GHSA-fq54-2j52-jc42","title":"Next.js Denial of Service (DoS) condition","description":"### Impact\nA Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server.\n\n**This vulnerability can affect all Next.js deployments on the affected versions.**\n\n### Patches\nThis vulnerability was resolved in Next.js 13.5 and later. We recommend that users upgrade to a safe version.\n\n### Workarounds\nThere are no official workarounds for this vulnerability.\n\n#### Credit\n* Thai Vu of [flyseccorp.com](http://flyseccorp.com/)\n* Aonan Guan (@0dd), Senior Cloud Security Engineer","status":"published","published":"2024-07-10T16:03:06Z","modified":"2026-09-10T03:50:16.556447999Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"ROOT-APP-NPM-CVE-2024-39693","title":"CVE-2024-39693 in next - Patched by Root","description":"Root has patched CVE-2024-39693 in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-18T07:15:12Z","modified":"2026-09-18T08:15:04.561167916Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}