Live › vulnerability › CVE-2026-94482
Go to dashboardCrafted requests to a Next.js App Router app that has at least one Server Action can drive CPU usage so high that the process stops handling further requests. An unauthenticated attacker gets a denial of service against the running process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| next | npm | >= 13.0.0, <= 15.5.27 | 15.5.28 |
| next | npm | >= 16.0.0, <= 16.4.0 | 16.4.1 |
15.5.28 or later on the 15.x line, or 16.4.1 or later on the 16.x lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-94482")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.