Skip to content
Threat Feed
Subscribe

Product

Next.js (>= 13.0.0, < 15.5.21)

1 brief RSS
medium advisory

Next.js: Denial of Service in App Router using Server Actions

A high-severity denial-of-service vulnerability (CVE-2026-64641) in Next.js applications utilizing the App Router with Server Actions allows an unauthenticated attacker to cause excessive CPU usage, leading to a complete service outage.

Next.js +1 denial-of-service web-application javascript nodejs
1t