CVE-2026-64641
Received Received - Intake

Excessive CPU Usage in Next.js App Router

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-64641
EUVD
EUVD-2026-49381

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
vercel next.js From 13.0.0 (inc) to 15.5.20 (inc)
vercel next.js From 16.0.0 (inc) to 16.2.10 (inc)
vercel next.js 15.5.21
vercel next.js 16.2.11
vercel next.js From 13.0.0 (inc) to 15.5.21 (exc)
vercel next.js From 16.0.0 (inc) to 16.2.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-834 The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-64641 is a Denial of Service (DoS) vulnerability in Next.js applications using the App Router with Server Actions. Crafted requests targeting Server Actions can cause excessive CPU usage, blocking further request processing in the same process. The issue affects versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10.

Detection Guidance

Detecting this vulnerability requires checking if your Next.js application uses the App Router with Server Actions and is running a vulnerable version (13.0.0 to 15.5.20 or 16.0.0 to 16.2.10). Inspect your package.json for Next.js version. Monitor server CPU usage spikes during form submissions involving Server Actions.

Impact Analysis

This vulnerability can lead to system instability or unavailability due to excessive CPU usage. It may cause applications to stop processing further requests, resulting in downtime or degraded performance for users.

Compliance Impact

This vulnerability causes excessive CPU usage leading to denial of service, which could disrupt system availability. For GDPR, this may impact data processing operations requiring availability under Article 32. For HIPAA, it could affect access to electronic protected health information by causing system unavailability.

Mitigation Strategies

Upgrade Next.js to version 15.5.21 or 16.2.11 or later immediately. If upgrading is not possible, disable Server Actions in your App Router configuration or restrict access to form endpoints until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64641. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart