CVE-2026-94482 Next.js: Denial of Service in App Router using Server Actions
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-94482?
CVE-2026-94482 is a high-severity vulnerability in vercel next.js, published on 22 Oct 2026.
Official description
Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.
Weakness: CWE-770
Which versions are affected by CVE-2026-94482?
4 open source packages ship an affected version, including next.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 13.0.0 | 15.5.28 |
next npm | From 13.0.0 | 15.5.28 |
next npm | From 16.0.0 | 16.4.1 |
next npm | From 16.0.0 | 16.4.1 |
How do I fix CVE-2026-94482?
Upgrade next to a fixed version for your release line: 15.5.28 or 16.4.1.
Is CVE-2026-94482 being exploited?
There is no known exploitation of CVE-2026-94482 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-TE57560, ECHO-7955-3140-c50d, GHSA-p3m5-59mp-jv5r, ROOT-APP-NPM-CVE-2026-94482.