Next.js versions 16.0.1 through 16.1.6 allow an attacker to send an HTTP POST request containing the `next-resume: 1` header, triggering unbounded postponed resume-body buffering. Because memory limits are not consistently enforced in non‑minimal deployments with Partial Prerendering enabled, oversized payloads can consume excessive memory, leading to a denial‑of‑service. This resource exhaustion flaw is categorized as CWE‑770, and based on the description it is inferred that no authentication is needed to launch the attack.

The affected product is Vercel’s Next.js framework. Versions 16.0.1 up to and including 16.1.6 are vulnerable. Applications using the App Router with Partial Prerendering enabled in non‑minimal deployments are impacted, while minimal-mode deployments remain protected by the previous mitigation.

The CVSS v3 score is 6.9, indicating moderate risk, and the EPSS score is less than 1 %, implying a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP POST request to a vulnerable Next.js application with the `next-resume` header; this inference comes from the fact that the description states an attacker can send oversized payloads without mentioning authentication.