CVE-2026-94482

Next.js: Denial of Service in App Router using Server Actions

At a glance

Severity: HIGH 8.2
EPSS: EPSS 0.36 % · percentile 30 (2026-10-27)
State: PUBLISHED
Published: 2026-10-22
Updated: 2026-10-22
Assigner: GitHub_M
NVD status: Awaiting Analysis

Description

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.

Scores

Version	Score	Vector	Scored by
CVSS 4.0	HIGH 8.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	GitHub_M
CVSS 4.0	HIGH 8.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · security-advisories@github.com (Secondary)

Weaknesses (CWE)

CWE-770

Advisories

GHSA-p3m5-59mp-jv5r — Next.js: Denial of Service in App Router using Server Actions

European references

ENISA EUVD · EUVD-2026-108214
GCVE · GCVE-0-2026-94482

Affected products

Product	Versions
vercel · next.js	affected >= 13.0.0, < 15.5.28 ; affected >= 16.0.0, < 16.4.1

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD