---
id: CVE-2026-94482
aliases:
  - GHSA-p3m5-59mp-jv5r
title: 'Next.js: Denial of Service in App Router using Server Actions'
summary: 'Next.js: Denial of Service in App Router using Server Actions'
severity: high
cvss: 8.2
cwe:
  - CWE-770
vendor: next
product: next
ecosystem: npm
affected:
  - 'next >= 13.0.0, <= 15.5.27'
  - 'next >= 16.0.0, <= 16.4.0'
patched:
  - next 15.5.28
  - next 16.4.1
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T15:50:35Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-p3m5-59mp-jv5r'
references:
  - url: 'https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r'
  - url: 'https://github.com/vercel/next.js/releases/tag/v15.5.28'
  - url: 'https://github.com/vercel/next.js/releases/tag/v16.4.1'
  - url: 'https://github.com/advisories/GHSA-p3m5-59mp-jv5r'
tags:
  - ghsa
  - npm
  - cve.org
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
ingestedAt: '2026-10-22T22:00:50.260Z'
---

## Overview

## Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

## Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

## Affected packages

- `next >= 13.0.0, <= 15.5.27`
- `next >= 16.0.0, <= 16.4.0`

## Remediation

Upgrade to a patched release:

- `next 15.5.28`
- `next 16.4.1`