All vulnerabilities
CVE-2026-94482GHSA-p3m5-59mp-jv5r

Next.js: Denial of Service in App Router using Server Actions

vercel nextnpmFrameworks
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in15.5.28Also 16.4.1GitHub
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

  • 15.5.28next, npmGitHubnpm install next@15.5.28
  • 16.4.1next, npmGitHubnpm install next@16.4.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

Text from GitHub Advisory Database

Affected versions 6

  • next, npm>= 13.0.0, <= 15.5.27GitHub
  • next, npm>= 16.0.0, <= 16.4.0GitHub
  • next.jsaffected: >= 13.0.0, < 15.5.28CVE List
  • next.jsaffected: >= 16.0.0, < 16.4.1CVE List
  • next, npmfrom 13.0.0, fixed in 15.5.28OSV
  • next, npmfrom 16.0.0, fixed in 16.4.1OSV

References 4