8.2

CVE-2026-64641

Medienbericht

Next.js: Denial of Service in App Router using Server Actions

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Vercel ≫ Next.Js SwPlatformnode.js Version >= 13.0.0 < 15.5.21
Vercel ≫ Next.Js SwPlatformnode.js Version >= 16.0.0 < 16.2.11
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.6% 0.453
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
security-advisories@github.com 8.2 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-834 Excessive Iteration

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
03.08.2026 16:28
https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12
Patch
https://github.com/vercel/next.js/pull/96013
Patch
Issue Tracking
https://github.com/vercel/next.js/releases/tag/v15.5.21
Product
Release Notes
https://github.com/vercel/next.js/releases/tag/v16.2.11
Product
Release Notes
https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj
Vendor Advisory