Skip to content

[GHSA-5f7q-jpqc-wp7h] Next.js has Unbounded Memory Consumption via PPR Resume Endpoint #7303

Open
jesvinjames wants to merge 1 commit intojesvinjames/advisory-improvement-7303from
jesvinjames-GHSA-5f7q-jpqc-wp7h
Open

[GHSA-5f7q-jpqc-wp7h] Next.js has Unbounded Memory Consumption via PPR Resume Endpoint #7303
jesvinjames wants to merge 1 commit intojesvinjames/advisory-improvement-7303from
jesvinjames-GHSA-5f7q-jpqc-wp7h

Conversation

@jesvinjames
Copy link
Copy Markdown

@jesvinjames jesvinjames commented Apr 4, 2026 •
edited
Loading

Updates

  • Affected products

Comments
Use last_affected to specify the upper bound for affected 15.x canary version ranges so that affected versions are correctly determined by systems using OSV schema. This fixes issue #7295

Last affected versions were determined by passing version ranges from GitHub Advisory through npm SemVer Calculator.

There are 2 rc versions in the range >= 15.0.0-canary.0, < 15.0.0. These are not included in the new version range >= 15.0.0-canary.0, <= 15.0.0-canary.205 because only canary versions of 15.x are affected based on the explanation here.

Modified version ranges

Old: >= 15.0.0-canary.0, < 15.0.0
New: >= 15.0.0-canary.0, <= 15.0.0-canary.205
2 rc versions removed but no change to canary versions.

Old: >= 15.0.1-canary.0, < 15.0.1
New: >= 15.0.1-canary.0, <= 15.0.1-canary.3
No change to affected versions list.

Old: >= 15.0.2-canary.0, < 15.0.2
New: >= 15.0.2-canary.0, <= 15.0.2-canary.11
No change to affected versions list.

Old: >= 15.0.3-canary.0, < 15.0.3
New: >= 15.0.3-canary.0, <= 15.0.3-canary.9
No change to affected versions list.

Old: >= 15.0.4-canary.0, < 15.0.4
New: >= 15.0.4-canary.0, <= 15.0.4-canary.52 
No change to affected versions list.

Old: >= 15.1.1-canary.0, < 15.1.1
New: >= 15.1.1-canary.0, <= 15.1.1-canary.27 
No change to affected versions list.

Old: >= 15.2.0-canary.0, < 15.2.0
New: >= 15.2.0-canary.0, <= 15.2.0-canary.77 
No change to affected versions list.

Old: >= 15.2.1-canary.0, < 15.2.1
New: >= 15.2.1-canary.0, <= 15.2.1-canary.6 
No change to affected versions list.

Old: >= 15.2.2-canary.0, < 15.2.2
New: >= 15.2.2-canary.0, <= 15.2.2-canary.7 
No change to affected versions list.

Old: >= 15.3.0-canary.0, < 15.3.0
New: >= 15.3.0-canary.0, <= 15.3.0-canary.46 
No change to affected versions list.

Old: >= 15.3.1-canary.0, < 15.3.1
New: >= 15.3.1-canary.0, <= 15.3.1-canary.15 
No change to affected versions list.

Old: >= 15.4.0-canary.0, < 15.4.0
New: >= 15.4.0-canary.0, <= 15.4.0-canary.130
No change to affected versions list.

Old: >= 15.4.2-canary.0, < 15.4.2
New: >= 15.4.2-canary.0, <= 15.4.2-canary.56 
No change to affected versions list.

Old: >= 15.5.1-canary.0, < 15.5.1
New: >= 15.5.1-canary.0, <= 15.5.1-canary.39 
No change to affected versions list.

@github
Copy link
Copy Markdown
Collaborator

github commented Apr 4, 2026

Hi there @andresriancho! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

@github-actions github-actions bot changed the base branch from main to jesvinjames/advisory-improvement-7303 April 4, 2026 23:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@add-apt-repository add-apt-repository add-apt-repository approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jesvinjames @github @add-apt-repository