GHSA-p3m5-59mp-jv5rhighDenial of service2026-10-14
Next.js Server Actions denial of service
Crafted requests to a Next.js App Router app with at least one Server Action can cause excessive CPU use that blocks other requests in the same process. Fixed in 16.4.1 and 15.5.28.
What it is
Next.js security release, 14 October 2026: “Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage. The CPU usage blocks processing of further requests in the same process, leading to Denial of Service.”
Apps using the Pages Router, or not using Server Actions, are not vulnerable. The related upstream React advisory is GHSA-h3gv-c5rc-p453.
How to check
- Affected: next (npm) 13.0.0 through 15.5.27, and 16.0.0 through 16.4.0.
- Check whether your app uses the App Router and has any Server Action (a function marked ‘use server’).
How to fix
- Upgrade next to 16.4.1 (16.x) or 15.5.28 (15.x). The advisory lists no workaround besides upgrading.
npm ls next
npm install next@16.4.1 # or next@15.5.28 on 15.5Sources
More advisories for this tool