~ / search / GHSA-p3m5-59mp-jv5r

GHSA-p3m5-59mp-jv5r

Next.js: Denial of Service in App Router using Server Actions

Source: GitHub Advisory Database (reviewed) High CVE-2026-94482

Packages

EcosystemPackageAffectedFixed in
npm next >= 13.0.0, < 15.5.28 15.5.28
npm next >= 16.0.0, < 16.4.1 16.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. ## Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

References

External links from the advisory. They lead to third-party sites.