Executive Summary
A denial of service (DoS) vulnerability has been discovered in Next.js applications that utilize the App Router with at least one Server Action. This vulnerability, tracked as CVE-2026-64641, allows crafted requests to cause excessive CPU usage, effectively blocking the processing of further requests in the same process. The severity of this vulnerability is rated at 8.2 on the CVSS v4 scale.
Technical Analysis
The vulnerability class of this issue is a denial of service (DoS) via excessive CPU usage. The attack vector involves sending crafted requests to Next.js applications that use the App Router and have at least one Server Action. The root cause of this vulnerability is the lack of proper input validation or rate limiting in the Server Actions feature of the App Router.
How It Gets Exploited
An attacker can exploit this vulnerability by sending a crafted request to a Next.js application that uses the App Router with at least one Server Action. This request would be designed to trigger excessive CPU usage, potentially blocking the processing of further requests in the same process. For example, an unauthenticated remote attacker could send a specifically crafted request to the vulnerable application, which would then consume excessive CPU resources, leading to a denial of service.
Impact Assessment
The impact of this vulnerability is a denial of service, where an attacker can cause the application to become unresponsive or significantly slow down due to excessive CPU usage. This affects Next.js versions from 13.0.0 to 15.5.20 and from 16.0.0 to 16.2.10. Applications using the Pages Router or not using Server Actions are not vulnerable.
Recommended Actions
To mitigate this vulnerability, it is recommended to update Next.js to version 15.5.21 or later for applications using version 15, or to version 16.2.11 or later for applications using version 16. No workarounds exist besides upgrading.
Sources
- GitHub Security Advisories: https://github.com/advisories/GHSA-m99w-x7hq-7vfj