CVE-2026-64641: Next.js: Denial of Service in App Router using Server Actions
Impact
Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.
Workarounds
No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.
Other sources
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64641?
CVE-2026-64641 has a risk score of 48.
What applications are affected by CVE-2026-64641?
CVE-2026-64641 affects Next.js applications using the App Router with at least one Server Action.
How can I mitigate the effects of CVE-2026-64641?
There are no workarounds for CVE-2026-64641; the only mitigation is to upgrade the application.
What impact does CVE-2026-64641 have on my application?
CVE-2026-64641 can lead to excessive CPU usage, which blocks the processing of further requests in the same process.
When was CVE-2026-64641 published?
CVE-2026-64641 was published on July 22, 2026.