---
id: CVE-2026-64641
aliases:
  - GHSA-m99w-x7hq-7vfj
title: 'Next.js: Denial of Service in App Router using Server Actions'
summary: 'Next.js: Denial of Service in App Router using Server Actions'
severity: high
cwe:
  - CWE-834
vendor: next
product: next
ecosystem: npm
affected:
  - 'next >= 13.0.0, < 15.5.21'
  - 'next >= 16.0.0, < 16.2.11'
patched:
  - next 15.5.21
  - next 16.2.11
published: '2026-07-22'
updated: '2026-07-22'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-m99w-x7hq-7vfj'
references:
  - url: 'https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj'
  - url: 'https://github.com/vercel/next.js/pull/96013'
  - url: >-
      https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12
  - url: 'https://github.com/vercel/next.js/releases/tag/v15.5.21'
  - url: 'https://github.com/vercel/next.js/releases/tag/v16.2.11'
  - url: 'https://github.com/advisories/GHSA-m99w-x7hq-7vfj'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-22T23:07:32.308Z'
epss: 0.01375
epssPercentile: 0.70844
---

## Overview

## Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

## Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

## Affected packages

- `next >= 13.0.0, < 15.5.21`
- `next >= 16.0.0, < 16.2.11`

## Remediation

Upgrade to a patched release:

- `next 15.5.21`
- `next 16.2.11`