~ / search / GHSA-m99w-x7hq-7vfj

GHSA-m99w-x7hq-7vfj

Next.js: Denial of Service in App Router using Server Actions

Source: GitHub Advisory Database (reviewed) High CVE-2026-64641

Packages

EcosystemPackageAffectedFixed in
npm next >= 13.0.0, < 15.5.21 15.5.21
npm next >= 16.0.0, < 16.2.11 16.2.11

Details

As written in the advisory (Markdown source, shown as plain text).

## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. ## Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

References

External links from the advisory. They lead to third-party sites.