Vulnerabilities / CVE-2026-94482

CVE-2026-94482

Published 2026-10-22 · Awaiting Analysis

CVE-2026-94482

Next.js: Denial of Service in App Router using Server Actions

8.2 HIGH
CVSS 4.0 · CNA · github.com

0.4%
chance of exploitation in the next 30 days (EPSS; higher than 30% of CVEs)

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.

Scores

8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NCNA · github.com

Affected packages and fixed versions

Package	Ecosystem	Fixed in
next	npm	15.5.28, 16.4.1

Affected products

vercel next.js: >= 13.0.0, < 15.5.28; >= 16.0.0, < 16.4.1

Weakness: CWE-770

Also known as: GHSA-p3m5-59mp-jv5r

3 references (advisories, patches, write-ups)

Sources: NVD, CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.

Look up another CVE Check your dependencies Scan a website