Fix Unrestricted Resource Consumption in Next.js
Unrestricted Resource Consumption in Next.js occurs when API routes or Server Actions lack rate limiting, payload size constraints, or execution timeouts. In a serverless environment, this translates directly to 'Denial of Wallet' or service unavailability as compute resources are exhausted by malicious bursts. To mitigate this, we must shift protection to the Edge and implement strict throttling.
The Vulnerable Pattern
export default async function handler(req, res) { // VULNERABLE: No rate limiting, no payload validation, and heavy computation const { imageUrl } = req.body;// An attacker can spam this endpoint with thousands of requests // to trigger expensive image processing and crash the instance or spike costs. const processedImage = await heavyImageTransform(imageUrl);
return res.status(200).json({ processedImage }); }
The Secure Implementation
The secure implementation utilizes a Middleware-based rate limiter at the Edge. By checking the requester's IP against a Redis-backed sliding window before the request reaches the API route, we prevent resource-intensive code from executing under load. Key defenses: 1. Implement global or route-specific rate limiting. 2. Enforce 'Content-Length' limits in body parsers. 3. Set strict 'maxDuration' in next.config.js for serverless functions to prevent zombie processes from hanging and consuming compute credits.
import { Ratelimit } from '@upstash/ratelimit'; import { Redis } from '@upstash/redis'; import { NextResponse } from 'next/server';const ratelimit = new Ratelimit({ redis: Redis.fromEnv(), limiter: Ratelimit.slidingWindow(5, ‘60 s’), // 5 requests per minute per IP });
export async function middleware(req) { const ip = req.ip ?? ‘127.0.0.1’; const { success, limit, reset, remaining } = await ratelimit.limit(ip);
if (!success) { return new NextResponse(‘Rate limit exceeded’, { status: 429, headers: { ‘X-RateLimit-Limit’: limit.toString(), ‘X-RateLimit-Reset’: reset.toString() } }); } return NextResponse.next(); }
export const config = { matcher: ‘/api/heavy-task/:path*’, };
Your Next.js API
might be exposed to Unrestricted Resource Consumption
74% of Next.js apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.