Next.js: Denial of service via Server Actions in App Router
Summary
Next.js, a React framework for full-stack web applications, is affected in App Router applications that use at least one Server Action. Crafted requests can drive CPU consumption to excessive levels and block further request processing in the same process. Pages Router applications and App Router applications without Server Actions are not affected. The attack is remote and requires no authentication or user interaction, but only availability is impacted.
Affected
- Next.js 13.0.0 up to and including 15.5.27
- Next.js 16.0.0 up to and including 16.4.0
Fixed in
- Next.js 15.5.28
- Next.js 16.4.1
Workaround
No workaround documented. Upgrading is the only fix.
Exploitation
- CISA SSVC: Exploitation none, automatable yes, technical impact partial
- Not listed in the CISA KEV catalog according to third-party checks
- No public proof of concept found; absence of evidence is not proof
Our recommendation
- Inventory all Next.js versions in web projects, build pipelines and internal applications
- Identify App Router applications that use Server Actions and prioritise public-facing ones
- Upgrade to 16.4.1 or later, or to 15.5.28 where a move to 16.x is not yet possible
- Ship the same release as the two critical RCE fixes (CVE-2026-96889 and GHSA-673q-mjm6-r5xr) in the same update
- Monitor for changes in exploitation status and re-check after each Next.js security release
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-p3m5-59mp-jv5r github.com
- Next.js release v15.5.28 github.com
- Next.js release v16.4.1 github.com
- Next.js security update, 14 October 2026 nextjs.org
- GitLab advisory database entry advisories.gitlab.com
- Brandefense: Next.js security updates October 2026 brandefense.io
- Rapid7 / Vulners record vulners.com
- VulDB entry vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:12.
Original description (NVD)
Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.