Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-27T17:40:01 next: Next.js: Denial of Service via crafted requests to App Router with Server Actions 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.

A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usage, causing the application to become unresponsive and preventing it from processing further requests, resulting in a Denial of Service (DoS).

Important: A denial of service flaw exists in Next.js applications utilizing the App Router with Server Actions. Crafted requests can lead to excessive CPU consumption, potentially disrupting service availability for affected Red Hat products that embed or depend on vulnerable Next.js versions. Cryostat 4 Not affected i18next Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/backend-rhel8 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/system-rhel7 Red Hat AMQ Broker 7 Not affected i18next Red Hat build of Apache Camel 4 for Quarkus 3 Not affected quarkus-websockets-next-spi Red Hat build of Apache Camel for Spring Boot 4 Not affected i18next Red Hat build of Apache Camel - HawtIO 4 Not affected quarkus-websockets-next-spi Red Hat build of Apicurio Registry 3 Not affected quarkus-websockets-next-spi Red Hat Build of Keycloak Affected quarkus-websockets-next-spi Red Hat build of Quarkus Not affected quarkus-websockets-next-deployment Red Hat Ceph Storage 5 Affected rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 6 Affected rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 7 Affected rhceph/grafana-rhel9 Red Hat Ceph Storage 8 Affected rhceph/grafana-rhel9 Red Hat Ceph Storage 9 Affected rhceph/alloy-rhel10 Red Hat Connectivity Link 1 Not affected rhcl-1/rhcl-console-plugin-rhel9 Red Hat Data Grid 8 Not affected i18next Red Hat Enterprise Linux 10 Affected firefox Red Hat Enterprise Linux 10 Affected thunderbird Red Hat Enterprise Linux 7 Affected firefox Red Hat Enterprise Linux 8 Affected firefox Red Hat Enterprise Linux 8 Affected thunderbird Red Hat Enterprise Linux 9 Affected firefox Red Hat Enterprise Linux 9 Affected thunderbird Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat JBoss Enterprise Application Platform 7 Fix deferred process-nextick-args Red Hat JBoss Enterprise Application Platform 8 Not affected i18next Red Hat Openshift Data Foundation 4 Not affected odf4/mcg-core-rhel9 Red Hat Single Sign-On 7 Fix deferred process-nextick-args Red Hat Trusted Artifact Signer Not affected rhtas/rekor-search-ui-rhel9 streams for Apache Kafka 2 Affected next streams for Apache Kafka 3 Affected next https://www.cve.org/CVERecord?id=CVE-2026-64641 https://nvd.nist.gov/vuln/detail/CVE-2026-64641 https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12 https://github.com/vercel/next.js/pull/96013 https://github.com/vercel/next.js/releases/tag/v15.5.21 https://github.com/vercel/next.js/releases/tag/v16.2.11 https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj