The vulnerability allows an attacker to craft POST requests to a Next.js server action that triggers a request‑body handling deadlock. The deadlock keeps file descriptors open, exhausting connection resources and eventually denying legitimate users access to the application. The weakness is an instance of resource exhaustion (CWE‑770).

Affected products are Vercel's Next.js framework, specifically all releases before version 15.5.16 and 16.2.5. Deployments that enable Partial Prerendering with Cache Components are vulnerable, while configurations that disable this feature or use newer releases are safe.

The CVSS score of 7.5 reflects a high severity risk. An EPSS score of 0.00019 (<1%) indicates a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be direct network access via crafted POST requests to the server, which can be exploited by attackers who can send requests to the application. No authentication requirement is specified, implying that any external user could trigger the DOS.