CVE-2026-94482: Next.js Server Action DOS Vulnerability

CVE-2026-94482 Overview

CVE-2026-94482 is a resource exhaustion vulnerability in Next.js, the React framework for full-stack web applications. Crafted HTTP requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption. The affected process blocks further request handling, resulting in a denial of service condition. The flaw affects Next.js versions from 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0. Applications using the Pages Router or App Router without any Server Actions are not affected. Vercel addressed the issue in Next.js 15.5.28 and 16.4.1.

Critical Impact
Remote, unauthenticated attackers can exhaust CPU resources on vulnerable Next.js servers, halting request processing for all users of the affected process.

Affected Products

Next.js versions 13.0.0 through 15.5.27 (App Router with Server Actions)
Next.js versions 16.0.0 through 16.4.0 (App Router with Server Actions)
Any Next.js deployment where at least one Server Action is defined in an App Router application

Discovery Timeline

2026-10-22 - CVE-2026-94482 published to the National Vulnerability Database
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-94482

Vulnerability Analysis

The vulnerability is a resource exhaustion flaw [CWE-770: Allocation of Resources Without Limits or Throttling] in the Server Actions request-handling path of the Next.js App Router. Server Actions let developers define server-executed functions invoked through specially formed HTTP requests. When a crafted request reaches an App Router application exposing at least one Server Action, Next.js performs disproportionate work while processing it. CPU usage spikes and the Node.js event loop stalls, preventing concurrent requests from making progress within the same process.

In multi-tenant or single-process deployments, a single attacker can degrade or disable the entire application. Horizontally scaled deployments remain exposed because the attack can be repeated across worker instances.

Root Cause

The root cause is missing input constraints on the Server Action request-processing pipeline. The handler accepts input shapes that trigger expensive internal operations without enforcing bounds on size, structure, or processing time. Because the operation runs synchronously on the Node.js event loop, excessive CPU work blocks all other request handlers in the same process.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted HTTP requests to any endpoint that invokes a Server Action, which includes any route in an App Router application once one Server Action is defined. The requests do not need to target a specific action by name; the presence of Server Action handling in the application is sufficient to expose the code path.

No verified public proof-of-concept code is available at the time of writing. See the GitHub Security Advisory GHSA-p3m5-59mp-jv5r for authoritative technical details.

Detection Methods for CVE-2026-94482

Indicators of Compromise

Sustained CPU saturation on Node.js worker processes serving Next.js App Router routes without a corresponding increase in legitimate traffic volume.
Event-loop lag metrics rising sharply, with request latency climbing across unrelated endpoints hosted by the same process.
Health checks or liveness probes failing on Next.js pods or containers while inbound request counts remain modest.
Repeated POST requests with Server Action headers (such as Next-Action) from a narrow set of source IP addresses.

Detection Strategies

Inventory all Next.js deployments and flag any instance running an affected version between 13.0.0 and 15.5.27 or between 16.0.0 and 16.4.0 that uses the App Router with Server Actions.
Correlate web server access logs with process-level CPU telemetry to identify request bursts that precede CPU exhaustion.
Baseline normal Server Action request rates per client and alert on statistical deviations.

Monitoring Recommendations

Instrument Node.js runtimes with event-loop lag and CPU utilization metrics exported to the SIEM.
Forward reverse proxy and application logs containing the Next-Action request header for retrospective hunting.
Set alerts on sustained per-process CPU above a defined threshold combined with elevated 5xx or timeout rates.

How to Mitigate CVE-2026-94482

Immediate Actions Required

Upgrade Next.js to 15.5.28 on the 15.x branch or 16.4.1 on the 16.x branch as soon as release testing permits.
Identify applications that combine the App Router with Server Actions and prioritize those for patching first.
Place a rate limiter or Web Application Firewall rule in front of affected endpoints to cap requests carrying Server Action headers.

Patch Information

Vercel released fixed builds in Next.js v15.5.28 and Next.js v16.4.1. Review the GitHub Security Advisory GHSA-p3m5-59mp-jv5r for the complete vendor advisory and version guidance before deploying.

Workarounds

Migrate affected routes to the Pages Router if Server Actions are not required, as Pages Router applications are not affected.
Remove or disable all Server Action definitions in the App Router until a patched version is deployed.
Enforce aggressive per-IP and per-route rate limits at the ingress controller or CDN layer for requests containing the Next-Action header.
Run Next.js behind a process manager configured to recycle workers that exceed CPU or memory thresholds to recover faster from sustained attacks.

bash

# Upgrade Next.js to a patched release
npm install next@15.5.28
# or, for the 16.x branch
npm install next@16.4.1

# Verify the installed version
npx next --version