PT-2026-121419
CVE-2026-94482
·
Published
2026-10-22
·
Updated
2026-10-25
Description by
CVSS 4.0
8.2
HighMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Next.js versions 13.0.0 through 15.5.27
Next.js versions 16.0.0 through 16.4.0
Description
Crafted requests targeting App Router applications that implement at least one Server Action can cause excessive CPU consumption. This resource exhaustion blocks the processing of subsequent requests within the same process. Applications utilizing the Pages Router or App Router applications without Server Actions are not impacted.
Recommendations
Update Next.js to version 15.5.28.
Update Next.js to version 16.4.1.
Found an issue in the description? Have something to add? Feel free to write us 👾