GHSA-p3m5-59mp-jv5r
Next.js: Denial of Service in App Router using Server Actions
At a glance
- Published
- Updated
- CVE
- CVE-2026-94482
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Description
## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. ## Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.
Affected packages
| Package | Versions |
|---|---|
| npm · next | introduced 13.0.0, fixed 15.5.28 |
| npm · next | introduced 16.0.0, fixed 16.4.1 |
References
- https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r WEB
- https://github.com/vercel/next.js PACKAGE
- https://github.com/vercel/next.js/releases/tag/v15.5.28 WEB
- https://github.com/vercel/next.js/releases/tag/v16.4.1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |