PT-2026-63556

CVE-2026-64641

Published

2026-07-22

Updated

2026-09-28

Description by

CVSS 4.0

8.2

High

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Next.js versions 13.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10

Description Crafted requests targeting applications using App Router with at least one Server Action can cause excessive CPU usage, which blocks the processing of subsequent requests within the same process.

Recommendations Update Next.js versions 13.0.0 through 15.5.20 to version 15.5.21. Update Next.js versions 16.0.0 through 16.2.10 to version 16.2.11.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-834: Excessive Iteration

Related identifiers

CVE-2026-64641

GHSA-M99W-X7HQ-7VFJ

CLEANSTART-2026-VZ23621