CVE-2026-64641

Опубликовано: 27 июл. 2026

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.

Ссылки

https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12
Patch
https://github.com/vercel/next.js/pull/96013
Issue Tracking
Patch
https://github.com/vercel/next.js/releases/tag/v15.5.21
Product
Release Notes
https://github.com/vercel/next.js/releases/tag/v16.2.11
Product
Release Notes
https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*

Версия от 13.0.0 (включая) до 15.5.21 (исключая)

cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*

Версия от 16.0.0 (включая) до 16.2.11 (исключая)

EPSS

Процентиль: 45%

0.00599

Низкий

7.5 High

CVSS3

Дефекты

CWE-834

Связанные уязвимости

CVE-2026-64641

CVSS3: 7.5

redhat

5 дней назад

A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usage, causing the application to become unresponsive and preventing it from processing further requests, resulting in a Denial of Service (DoS).

GHSA-m99w-x7hq-7vfj

github

10 дней назад

Next.js: Denial of Service in App Router using Server Actions