Vulnerability · Published Oct 22, 2026 · Assigned by GitHub_M

CVE-2026-94482Next.js: Denial of Service in App Router using Server Actions

High 8.2

In plain English

A high-severity resource allocation without limits in next.js from vercel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.4%top 67.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	next	15.5.28	GHSA-p3m5-59mp-jv5r
npm	next	16.4.1	GHSA-p3m5-59mp-jv5r

Affected products (as reported)

Vendor	Product	Versions
vercel	next.js	>= 13.0.0, < 15.5.28>= 16.0.0, < 16.4.1

Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r x_refsource_CONFIRM
https://github.com/vercel/next.js/releases/tag/v15.5.28 x_refsource_MISC
https://github.com/vercel/next.js/releases/tag/v16.4.1 x_refsource_MISC