PatchSiren cyber security CVE debrief

CVE-2026-94482 vercel CVE debrief

A denial-of-service vulnerability exists in Next.js applications using App Router with at least one Server Action. Crafted requests can lead to excessive CPU usage, blocking further requests in the same process. No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable. The vulnerability is described in the CVE record and source item from osv_dev, which provide details on the affected versions and potential impact. Defenders should assess exposure and prioritize upgrading to fixed versions.

Vendor: vercel
Product: next
CVSS: HIGH 8.2
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-22
Original CVE updated: 2026-10-22
Advisory published: 2026-10-22
Advisory updated: 2026-10-22

Who should care

Defenders of Next.js applications using App Router with Server Actions should assess exposure and prioritize upgrading to fixed versions to prevent potential denial-of-service. This includes reviewing and updating affected versions, monitoring for crafted requests, and verifying the security of their applications.

Why it matters

Defenders of Next.js applications using App Router with Server Actions should assess exposure and prioritize upgrading to fixed versions to prevent potential denial-of-service.

Potential denial-of-service due to excessive CPU usage
Need to verify and upgrade to fixed versions

Technical summary

The vulnerability exists in Next.js applications using App Router with at least one Server Action. Crafted requests can lead to excessive CPU usage, blocking further requests in the same process. The affected versions are 13.0.0 to 15.5.27 and 16.0.0 to 16.4.0. Defenders should prioritize upgrading to fixed versions, 15.5.28 or 16.4.1, to mitigate this vulnerability. The CVE record and source item from osv_dev provide details on the vulnerability and affected scope. The vulnerability can cause potential denial-of-service due to excessive CPU usage.

Defensive priority

Defenders should prioritize upgrading to fixed versions, 15.5.28 or 16.4.1, to mitigate this vulnerability.

Recommended defensive actions

Upgrade to version 15.5.28 or 16.4.1
Review and update affected versions
Monitor for crafted requests
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is described in the CVE record and the source item from osv_dev. The affected versions are 13.0.0 to 15.5.27 and 16.0.0 to 16.4.0. Defenders should verify and upgrade to fixed versions, 15.5.28 or 16.4.1, to mitigate this vulnerability. The CVE record was published on 2026-10-22T15:50:34.000Z and has not been modified since then.

Sources and references

Verified primary and authoritative sources

CVE-2026-94482 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-94482

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-94482 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-94482

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Next.js: Denial of Service in App Router using Server Actions
Unverified legacy reference

URL: https://storage.googleapis.com/osv-vulnerabilities/npm/GHSA-p3m5-59mp-jv5r.json

osv_dev
Source reference
Unverified legacy reference

URL: https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r

Supplemental source
Source reference
Unverified legacy reference

URL: https://github.com/vercel/next.js

Supplemental source
Source reference
Unverified legacy reference

URL: https://github.com/vercel/next.js/releases/tag/v15.5.28

Supplemental source
Source reference
Unverified legacy reference

URL: https://github.com/vercel/next.js/releases/tag/v16.4.1

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.