Update Next.js to 15.5.28 or 16.4.1 to Block Server Action CPU Exhaustion
Attackers can freeze Next.js App Router processes using crafted requests. Teams must patch to versions 15.5.28 or 16.4.1 immediately to prevent service denial.
Key points
- CVE-2026-94482 allows remote CPU exhaustion in Next.js versions 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0.
- The flaw affects only App Router applications that implement at least one Server Action.
- Vercel released fixes in Next.js 15.5.28 and 16.4.1; no workarounds exist other than upgrading.
Vercel has released critical patches for Next.js to address a remote denial-of-service vulnerability that can exhaust server CPU resources. The issue, tracked as CVE-2026-94482, affects widely used versions of the React framework. According to the National Vulnerability Database, the flaw carries a CVSS score of 8.2, rating it as high severity. This development follows similar infrastructure risks, such as the Eclipse OpenJ9 JITServer crash issue BlueTeam Herald reported on 2026-10-21, highlighting ongoing stability concerns in development toolchains.
The risk
An attacker can trigger excessive CPU consumption by sending crafted requests to a vulnerable Next.js application. This activity blocks the processing of further requests within the same process, effectively denying service to legitimate users. The vulnerability is classified under CWE-770, indicating an allocation of resources without limits or throttling. The National Vulnerability Database describes the issue as allowing crafted requests to cause excessive CPU consumption and block processing of further requests in the same process.
Who is exposed
Developers using Next.js version 13.0.0 or later are exposed if they have not applied the latest updates. Specifically, versions up to 15.5.27 and versions from 16.0.0 up to 16.4.0 are vulnerable. However, the risk is narrow. Applications relying on the Pages Router are not affected. Additionally, App Router applications that do not utilize Server Actions are safe from this specific exploit. Only those combining the App Router with at least one Server Action face this exposure.
Cost and compliance
The source materials do not provide specific data regarding financial losses, regulatory penalties, or compliance impacts associated with CVE-2026-94482. The National Vulnerability Database and GitHub advisory focus strictly on the technical severity and affected versions. No information is available regarding whether this flaw has been exploited in the wild or if any organizations have reported breaches resulting from this specific CPU exhaustion vector.
Our take on the response
Security teams should prioritize patching Next.js deployments immediately, as no alternative mitigations exist. The absence of workarounds means that any unpatched App Router with Server Actions remains fully exposed to remote denial-of-service attacks. Managers should verify that their CI/CD pipelines are configured to pull the latest stable releases, ensuring that 15.5.28 or 16.4.1 are deployed before any new code merges.
What defenders should look for
Teams usually detect this type of resource exhaustion through sudden spikes in CPU utilization on application servers. Monitor for processes that hang or fail to respond to health checks while consuming high processing power. Check web server logs for repeated requests to endpoints that trigger Server Actions. If a process becomes unresponsive, restart the service to restore availability while investigating the request patterns. Look for unusual latency increases that correlate with specific API calls.
What to do and how to stay safe: Next.js
- Inventory all Next.js applications to identify those using the App Router with Server Actions.
- Upgrade vulnerable instances to Next.js 15.5.28 or 16.4.1 as soon as possible.
- Monitor server CPU metrics for abnormal spikes that indicate potential exploitation attempts.
- Review application logs for repeated requests to Server Action endpoints from single sources.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is my Next.js application vulnerable if I use the Pages Router?
No, applications using the Pages Router are not affected by CVE-2026-94482, according to the GitHub advisory.
Can I mitigate this issue without upgrading Next.js?
No, the GitHub advisory states that no workaround exists besides upgrading to the patched versions.
Which versions of Next.js are fixed?
The vulnerability is fixed in Next.js versions 15.5.28 and 16.4.1, as confirmed by the National Vulnerability Database.
