---
id: "CVE-2026-94482"
kind: "vulnerability"
aliases: ["CVE-2026-94482", "GHSA-p3m5-59mp-jv5r"]
title: "Next.js: Denial of Service in App Router using Server Actions"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "next", "fixed": ["15.5.28"], "affected": ">= 13.0.0, <= 15.5.27", "ecosystem": "npm"}, {"name": "next", "fixed": ["16.4.1"], "affected": ">= 16.0.0, <= 16.4.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-770", "next.js", "node", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "no-server-actions", "pages-router"]
published_at: "2026-10-22T15:50:34+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:57:31+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-p3m5-59mp-jv5r", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94482", "first_seen_at": "2026-10-23T21:57:31+00:00"}]
---

# Next.js: Denial of Service in App Router using Server Actions

Crafted requests to a Next.js App Router app that has at least one Server Action can drive CPU usage so high that the process stops handling further requests. An unauthenticated attacker gets a denial of service against the running process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:next affected >= 13.0.0, <= 15.5.27 fixed 15.5.28
- npm:next affected >= 16.0.0, <= 16.4.0 fixed 16.4.1

## How to check

Check the installed next version in package.json and the lockfile (npm ls next).
Apps on Pages Router or with no Server Actions are not affected per the advisory.

## Fix

Upgrade next to 15.5.28 or later on the 15.x line, or 16.4.1 or later on the 16.x line. No workaround exists besides upgrading.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-p3m5-59mp-jv5r
- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94482

## From the sources

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_