CVE-2026-64641: Vercel Next.js DOS Vulnerability

CVE-2026-64641 Overview

CVE-2026-64641 is a denial-of-service vulnerability in Vercel Next.js affecting the App Router when at least one Server Action is defined. Crafted requests trigger excessive CPU consumption during multi-page application (MPA) form submission validation. The blocking behavior stalls further request processing in the same Node.js process, degrading availability for all users served by that worker.

The issue impacts Next.js versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10. Vercel released fixes in versions 15.5.21 and 16.2.11. The weakness is classified as CWE-834: Excessive Iteration.

Critical Impact
A remote unauthenticated attacker can exhaust CPU resources on Next.js App Router applications, blocking the affected Node.js process from serving legitimate traffic.

Affected Products

Vercel Next.js 13.0.0 through 15.5.20
Vercel Next.js 16.0.0 through 16.2.10
Next.js applications using App Router with at least one Server Action

Discovery Timeline

2026-07-27 - CVE-2026-64641 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-64641

Vulnerability Analysis

Next.js App Router supports Server Actions, which serialize form submissions and dispatch them to server-side handlers. When a request arrives that resembles an MPA (multi-page application) form submission, Next.js validates the action IDs contained in the payload before decoding it. The validation path in packages/next/src/server/app-render/action-handler.ts iterates through references in the incoming FormData without a bounded ceiling on how many action references it will process.

An attacker sends a form payload containing a very large number of action reference fields. Each reference triggers per-item work during validation, and the aggregate cost scales with attacker-controlled input. Because Node.js executes JavaScript on a single event-loop thread, the CPU-bound loop blocks every other request handled by that process until the loop completes.

Root Cause

The root cause is the absence of an early-exit bound when iterating over action references during MPA form validation. The upstream patch introduces a seenActionRefs counter that limits how many references the validator inspects before short-circuiting, preventing algorithmic amplification from a single request.

Attack Vector

Exploitation requires only network access to the target application. No authentication, user interaction, or prior privileges are needed. The attacker submits a crafted HTTP form request to any endpoint served by the App Router when at least one Server Action is registered in the application.

typescript

// Patched validator in packages/next/src/server/app-render/action-handler.ts
// Adds a bounded counter to prevent unbounded iteration during
// MPA form-submission validation.
  mpaFormData: FormData,
  serverModuleMap: ServerModuleMap
): boolean {
+ let seenActionRefs = 0
  let hasAtLeastOneAction = false
  // Before we attempt to decode the payload for a possible MPA action, assert that all
  // action IDs are valid IDs. If not we should disregard the payload

Source: vercel/next.js commit 0196285

Detection Methods for CVE-2026-64641

Indicators of Compromise

Sustained high CPU utilization on Node.js worker processes hosting Next.js App Router applications.
Sharp increase in request latency or timeouts for endpoints served by the affected process while inbound POST volume remains modest.
HTTP POST requests carrying multipart/form-data or application/x-www-form-urlencoded bodies with an unusually large number of action reference fields.
Event-loop lag spikes reported by Node.js runtime metrics correlated with specific client IPs.

Detection Strategies

Inspect application access logs for POST requests to App Router routes with abnormally large form payloads or repeated identical fields.
Enable Node.js event-loop lag monitoring and alert when lag exceeds normal baselines on Next.js hosts.
Deploy request-size and field-count limits at the reverse proxy or WAF layer, and log requests that exceed them.

Monitoring Recommendations

Track per-process CPU time and correlate spikes with inbound request identifiers to isolate offending clients.
Alert on repeated 5xx responses or upstream timeouts from Next.js origins behind load balancers.
Baseline typical Server Action payload sizes and flag statistical outliers for review.

How to Mitigate CVE-2026-64641

Immediate Actions Required

Upgrade Next.js to 15.5.21 or 16.2.11 on all deployments using the App Router.
Inventory applications for Server Action usage; any App Router app with at least one Server Action is in scope.
Restart Node.js processes after upgrading to ensure the patched validator is loaded.
Place rate limits on POST endpoints served by Next.js at the CDN or reverse proxy layer.

Patch Information

Vercel published fixes in Next.js v15.5.21 and v16.2.11. Technical detail is available in the GitHub Security Advisory GHSA-m99w-x7hq-7vfj and pull request #96013.

Workarounds

If patching is not immediately possible, enforce strict maximum body size and form-field count limits at the ingress proxy (for example, Nginx client_max_body_size and WAF field-count rules).
Temporarily remove or disable Server Actions from the App Router until patches are applied; the vulnerability is not exploitable without at least one Server Action registered.
Run multiple Node.js worker processes behind a load balancer so a stalled process does not take down the entire service, while treating this only as a partial mitigation.

bash

# Nginx example: cap request body and reject oversized form submissions
# to reduce exposure until Next.js is upgraded to 15.5.21 or 16.2.11
http {
  client_max_body_size 256k;
  client_body_buffer_size 128k;

  limit_req_zone $binary_remote_addr zone=nextjs_post:10m rate=10r/s;

  server {
    location / {
      limit_req zone=nextjs_post burst=20 nodelay;
      proxy_pass http://nextjs_upstream;
    }
  }
}