Next.js CPU Exhaustion via Server Action (v13.0.015.5.20/16.0.016.2.10)
CVE-2026-64641 Published on July 27, 2026
Next.js: Denial of Service in App Router using Server Actions
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.
Vulnerability Analysis
CVE-2026-64641 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Excessive Iteration
The software performs an iteration or loop without sufficiently limiting the number of times that the loop is executed. If the iteration can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory. In many cases, a loop does not need to be infinite in order to cause enough resource consumption to adversely affect the software or its host system; it depends on the amount of resources consumed per iteration.
Products Associated with CVE-2026-64641
stack.watch emails you whenever new vulnerabilities are published in Vercel Next Js or Red Hat Kafka. Just hit a watch button to start following.
Affected Versions
vercel next.js:- Version >= 13.0.0, < 15.5.21 is affected.
- Version >= 16.0.0, < 16.2.11 is affected.