{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/next.js--13.0.0--15.5.21/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Next.js (\u003e= 13.0.0, \u003c 15.5.21)","Next.js (\u003e= 16.0.0, \u003c 16.2.11)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","web-application","javascript","nodejs"],"_cs_type":"advisory","_cs_vendors":["Vercel"],"content_html":"\u003cp\u003eA high-severity denial-of-service vulnerability, identified as CVE-2026-64641, affects Next.js applications that are configured to use the App Router alongside at least one Server Action. This flaw allows an unauthenticated remote attacker to send specially crafted HTTP requests to the vulnerable application. Upon receiving such a request, the Next.js process can enter a state of excessive CPU utilization, thereby blocking the processing of all further legitimate requests. This sustained resource exhaustion leads to a complete unavailability of the web service for legitimate users. The vulnerability affects Next.js versions greater than or equal to 13.0.0 and less than 15.5.21, as well as versions greater than or equal to 16.0.0 and less than 16.2.11. Applications not employing the App Router or Server Actions are not susceptible. This vulnerability poses a significant risk to the availability of critical web applications built with Next.js, making immediate patching crucial for maintaining service uptime.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker sends a specially crafted HTTP request to a vulnerable Next.js application endpoint.\u003c/li\u003e\n\u003cli\u003eThe crafted request specifically targets an application configured with the App Router and at least one Server Action.\u003c/li\u003e\n\u003cli\u003eProcessing the malicious request triggers an uncontrolled internal operation, causing the Next.js application process to consume excessive CPU resources.\u003c/li\u003e\n\u003cli\u003eThe sustained, high CPU utilization overwhelms the application, preventing it from handling legitimate incoming requests.\u003c/li\u003e\n\u003cli\u003eThe Next.js application becomes unresponsive, resulting in a denial of service for all users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-64641 leads to a complete denial of service for affected Next.js applications. Attackers can trigger excessive CPU usage in the application process, which in turn blocks the processing of all further requests. This effectively renders the web application inaccessible to legitimate users, disrupting business operations and potentially causing significant financial losses due to service downtime. There is no observed data on the number of victims or specific sectors targeted, but any organization using vulnerable Next.js versions with the App Router and Server Actions is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-64641 immediately by upgrading Next.js to version 15.5.21 or later, or 16.2.11 or later, as referenced in the affected_products section.\u003c/li\u003e\n\u003cli\u003eMonitor CPU utilization on servers hosting Next.js applications, especially those using App Router and Server Actions, for anomalous spikes indicative of a DoS attack.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for unusual patterns or high request rates directed towards Next.js App Router endpoints that utilize Server Actions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T22:59:42Z","date_published":"2026-07-22T22:59:42Z","id":"https://feed.craftedsignal.io/briefs/2026-07-nextjs-dos/","summary":"A high-severity denial-of-service vulnerability (CVE-2026-64641) in Next.js applications utilizing the App Router with Server Actions allows an unauthenticated attacker to cause excessive CPU usage, leading to a complete service outage.","title":"Next.js: Denial of Service in App Router using Server Actions","url":"https://feed.craftedsignal.io/briefs/2026-07-nextjs-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Next.js (\u003e= 13.0.0, \u003c 15.5.21)","version":"https://jsonfeed.org/version/1.1"}