Practical Security Guides For Your Team

Your website is running an outdated version of Next.js (the framework powering your web app) that contains a known security flaw. Under specific conditions, this flaw could allow an outside visitor to trick your server into making requests to internal systems it shouldn't be able to reach. A patch is available and the fix is straightforward — update to the latest version.

A flaw in a specific Next.js feature called Partial Prerendering (PPR) allows anyone on the internet to crash your web server by sending a specially crafted request — no login required. This only affects self-hosted Next.js applications running in a specific 'minimal mode' configuration with PPR turned on. If your app is hosted on Vercel's platform, you are not affected.