GitHub Advisoryadvisory · npm

GHSA-p3m5-59mp-jv5r Next.js: Denial of Service in App Router using Server Actions

HIGH Published 2026-10-22 Modified 2026-10-22 Official page ↗
Aliases
CVE-2026-94482
Ecosystem
npm
Packages
next
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-770
Reviewed
2026-10-22

Affected packages

• npm next: >= 13.0.0, < 15.5.28 → fixed in 15.5.28 • npm next: >= 16.0.0, < 16.4.1 → fixed in 16.4.1

Description

Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

Related

Alias · CVE (1)

  • CVE-2026-94482 Next.js is a React framework for building full-stack web applications. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References