CVE-2026-64641CWE-834

Next.js: Denial of Service in App Router using Server Actions

High · published July 27, 2026

CVSS v4.0
8.2
EPSS
1%
Percentile
58.0
In the wild
Unconfirmed
What it is

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00856 · 58.0th percentile
Weakness
CWE-834 · Excessive Iteration
Published
2026-07-27T17:40Z
EPSS history
Timeline
  • 27 JUL 17:40Z
    Next.js: Denial of Service in App Router using Server Actions
    cvelistv5