CVE-2026-94482High· 8.2▾ TwilightNext.js: Denial of Service in App Router using Server Actions
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.
No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.
next >= 13.0.0, <= 15.5.27next >= 16.0.0, <= 16.4.0Upgrade to a patched release:
next 15.5.28next 16.4.1Connected by shared product, vendor, weakness, or advisory.
GHSA-2464-fhr4-w9xwCriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
GHSA-673q-mjm6-r5xrCriticalNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
GHSA-vcvr-r3jv-pc5jCriticalNext.js: Remote Code Execution in next/og ImageResponse
GHSA-2xp9-vwfh-vxw4CriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
CVE-2026-75604Critical· 9.0Next.js is a React framework for building full-stack web applications
CVE-2026-64643MediumNext.js: Unauthenticated disclosure of internal Server Function endpoints