GHSA-p3m5-59mp-jv5r

ghsaUSosv

Next.js: Denial of Service in App Router using Server Actions

view advisory published 2026-10-22Licence: CC-BY-4.0

## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. ## Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-94482US	—	0.36% (30th)	—	2026-10-22
Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Se…

references

External citations — patches, advisories, analysis.

https://github.com/vercel/next.jsPACKAGE
https://github.com/vercel/next.js/releases/tag/v15.5.28WEB
https://github.com/vercel/next.js/releases/tag/v16.4.1WEB
https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5rWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan