Next.js: Denial of Service in App Router using Server Actions (CVE-2026-94482)
Severity: high · Patch status: patched · Since 2026-10-14 · CVE-2026-94482
A high-severity denial-of-service vulnerability (CVE-2026-94482, GHSA-p3m5-59mp-jv5r) affects Next.js applications using the App Router with at least one Server Action. Crafted requests can cause excessive CPU usage that blocks processing of further requests in the same process. Affected versions are next = 13.0.0 through 15.5.27 and = 16.0.0 through 16.4.0. Applications using the Pages Router or not using Server Actions are not vulnerable. No workaround exists besides upgrading. Fixed versions 15.5.28 and 16.4.1 were released October 14, 2026; the advisory was published to the GitHub Advisory Database on October 22, 2026. No in-the-wild exploitation is reported.
What to do
- Upgrade Next.js to 15.5.28 or 16.4.1 (or later) immediately if using App Router with Server Actions
- If upgrading is not immediately possible, restrict or monitor Server Action endpoints and watch for CPU exhaustion
- Audit all Next.js deployments and dependencies for affected versions
- Note that Pages Router apps or apps without Server Actions are not affected — verify your usage before prioritizing
Fixed versions
Sources
All live incidents on Threat Watch
