CVE-2026-94482— Next.js: Denial of Service in App Router using Server Actions
Quick assessment
Affected
vercel next.js
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Next.js 是一个用于构建全栈 Web 应用的 React 框架。在版本 13.0.0 至 15.5.28 以及 16.4.1 中，针对包含至少一个 Server Action 的 App Router 应用，精心构造的请求可能导致 CPU 消耗过高，并阻塞同一进程中后续请求的处理。使用 Pages Router 的应用，以及不包含 Server Action 的 App Router 应用不受此问题影响。该问题已在版本 15.5.28 和 16.4.1 中修复。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-94482
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Next.js: Denial of Service in App Router using Server Actions
Source: CVE Program / CVE List V5
Vulnerability Description
Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-94482
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-94482
请登录查看更多情报信息。
Other References for CVE-2026-94482 (3)
-
https://github.com/vercel/next.js/releases/tag/v16.4.1 x_refsource_MISC
-
https://github.com/vercel/next.js/releases/tag/v15.5.28 x_refsource_MISC
-
https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: next.js
-
CVE-2026-94484
Next.js: Cache poisoning in Next.js SSG/ISR rendering leads -
CVE-2026-94485
Next.js: Information disclosure in Next.js App Router metada -
CVE-2026-94483
Next.js: Server-Side Request Forgery in Image Optimization -
CVE-2026-94543
Next.js: Cache poisoning of SSG and ISR pages in self-hosted -
CVE-2026-94544
Next.js: Pending `use cache` fill can leak Draft Mode conten
Same vendor: vercel
-
CVE-2026-109375
Vercel deepsec before 1.1.17 Arbitrary File Write via Symlin -
CVE-2026-94484
Next.js: Cache poisoning in Next.js SSG/ISR rendering leads -
CVE-2026-94485
Next.js: Information disclosure in Next.js App Router metada -
CVE-2026-94483
Next.js: Server-Side Request Forgery in Image Optimization -
CVE-2026-94543
Next.js: Cache poisoning of SSG and ISR pages in self-hosted
Same weakness: CWE-770
-
CVE-2026-115398
Ghidra before 12.2 Denial of Service via TAR and ZIP File Sy -
CVE-2026-115397
Ghidra before 12.2 Denial of Service via Extension Archive I -
CVE-2026-115395
Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.re -
CVE-2026-115391
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbou -
CVE-2026-115389
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 be
V. Comments for CVE-2026-94482
No comments yet