CVE-2026-94482

Summary

Next.js: Denial of Service in App Router using Server Actions

Severity

high

EPSS

0.4% (p30)

CWE

CWE-770

Also known as

GHSA-p3m5-59mp-jv5r

Published

2026-10-22

Updated

2026-10-22

Advisory details

Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

References

• https://github.com/advisories/GHSA-p3m5-59mp-jv5r
• https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r
• https://github.com/vercel/next.js/releases/tag/v15.5.28
• https://github.com/vercel/next.js/releases/tag/v16.4.1

Related advisories

• CVE-2026-64646 — medium · npm/next
• GHSA-673q-mjm6-r5xr — critical · npm/next
• GHSA-2464-fhr4-w9xw — critical · npm/next
• GHSA-vcvr-r3jv-pc5j — critical · npm/next
• GHSA-2xp9-vwfh-vxw4 — critical · npm/next
• CVE-2026-75604 — critical · npm/next
• CVE-2026-94483 — high · npm/next
• CVE-2026-64649 — high · npm/next

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity