--- title: "Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up" system_id: "nextjs" category: "frameworks" advisory_mode: "core" published_date: "2025-12-12T17:21:57Z" updated_date: "2026-02-04T02:46:38.768104Z" severity: "low" exploit_status: "unknown" source_confidence: "official" target_types: - "lab-local" - "lab-public" - "authorized-third-party" allow_public_validation: "yes, with ownership or explicit authorization" authorization_prerequisite: "asset ownership proof or explicit written authorization" minimal_validation: "read-only probe, controlled payload, reversible test" aliases: - "GHSA-5j59-xgg2-r9c4" affected_versions: - "introduced=13.3.1-canary.0, fixed<14.2.35" - "introduced=15.0.6, fixed<15.0.7" - "introduced=15.1.10, fixed<15.1.11" - "introduced=15.2.7, fixed<15.2.8" - "introduced=15.3.7, fixed<15.3.8" - "introduced=15.4.9, fixed<15.4.10" - "introduced=15.5.8, fixed<15.5.9" - "introduced=15.6.0-canary.59, fixed<15.6.0-canary.60" - "introduced=16.0.9, fixed<16.0.10" - "introduced=16.1.0-canary.17, fixed<16.1.0-canary.19" fixed_versions: - "14.2.35" - "15.0.7" - "15.1.11" - "15.2.8" - "15.3.8" - "15.4.10" - "15.5.9" - "15.6.0-canary.60" - "16.0.10" - "16.1.0-canary.19" secure_code_topics: - "authz-server-side-recheck" - "proxy-trust-boundary" - "token-cookie-storage" primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-5j59-xgg2-r9c4" --- # Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up ## 事件层 - Canonical ID: `nextjs--GHSA-5j59-xgg2-r9c4` - 系统: `nextjs` - 严重度: `low` - 来源置信度: `official` - 官方主源: https://github.com/vercel/next.js/security/advisories/GHSA-5j59-xgg2-r9c4 - 影响版本: `introduced=13.3.1-canary.0, fixed<14.2.35, introduced=15.0.6, fixed<15.0.7, introduced=15.1.10, fixed<15.1.11, introduced=15.2.7, fixed<15.2.8, introduced=15.3.7, fixed<15.3.8, introduced=15.4.9, fixed<15.4.10, introduced=15.5.8, fixed<15.5.9, introduced=15.6.0-canary.59, fixed<15.6.0-canary.60, introduced=16.0.9, fixed<16.0.10, introduced=16.1.0-canary.17, fixed<16.1.0-canary.19` - 修复版本: `14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 15.6.0-canary.60, 16.0.10, 16.1.0-canary.19` ## 其他来源 - https://nvd.nist.gov/vuln/detail/CVE-2025-67779 - https://github.com/vercel/next.js - https://nextjs.org/blog/security-update-2025-12-11 - https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components - https://www.cve.org/CVERecord?id=CVE-2025-55184 - https://www.facebook.com/security/advisories/cve-2025-67779 ## 实验层 - 仅用于自有资产、测试环境或已明确授权目标。 - 允许公网可达目标，但必须满足资产归属或明确授权前提。 - 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。 - 若该案例涉及插件、模块或扩展，应同时检查供应链与升级策略。 - 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作 ## 修复示例 - [javascript-typescript:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/javascript-typescript/authz-server-side-recheck.md) - [nodejs:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/nodejs/authz-server-side-recheck.md) - [java:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/java/authz-server-side-recheck.md) - [php:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/php/authz-server-side-recheck.md) - [python:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/python/authz-server-side-recheck.md) - [ruby:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/ruby/authz-server-side-recheck.md) - [csharp:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/csharp/authz-server-side-recheck.md) - [go:authz-server-side-recheck](/Users/x/websafe/05-defense/secure-code/go/authz-server-side-recheck.md) - [javascript-typescript:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/javascript-typescript/proxy-trust-boundary.md) - [nodejs:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/nodejs/proxy-trust-boundary.md) - [java:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/java/proxy-trust-boundary.md) - [php:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/php/proxy-trust-boundary.md) - [python:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/python/proxy-trust-boundary.md) - [ruby:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/ruby/proxy-trust-boundary.md) - [csharp:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/csharp/proxy-trust-boundary.md) - [go:proxy-trust-boundary](/Users/x/websafe/05-defense/secure-code/go/proxy-trust-boundary.md) - [javascript-typescript:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/javascript-typescript/token-cookie-storage.md) - [nodejs:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/nodejs/token-cookie-storage.md) - [java:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/java/token-cookie-storage.md) - [php:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/php/token-cookie-storage.md) - [python:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/python/token-cookie-storage.md) - [ruby:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/ruby/token-cookie-storage.md) - [csharp:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/csharp/token-cookie-storage.md) - [go:token-cookie-storage](/Users/x/websafe/05-defense/secure-code/go/token-cookie-storage.md)