CVE-2026-94482

What it actually does

Crafted HTTP requests to Server Actions in affected Next.js App Router applications trigger excessive CPU consumption that blocks processing of subsequent requests within the same Node.js process.

Why it matters to the business

Web applications built with Next.js can experience prolonged slowdowns or outages, disrupting user access and business operations until the process is restarted or traffic is mitigated.

How an attack unfolds

An attacker identifies a Next.js application using the App Router with at least one Server Action, then sends specially crafted requests that force the server to perform expensive computation, exhausting CPU resources and denying service to legitimate users.

How to fix it

Upgrade Next.js to version 15.5.28 or 16.4.1. Applications using only the Pages Router or App Router without Server Actions require no changes.

How to confirm the fix worked

Verify the installed Next.js version meets or exceeds 15.5.28 or 16.4.1; test that crafted Server Action requests no longer cause excessive CPU usage.

Typical attack path

1. Scan for publicly reachable Next.js applications exposing App Router endpoints with Server Actions
2. Craft and send repeated malicious requests targeting Server Action handlers
3. Observe sustained high CPU usage that prevents further request processing

How to detect it

Review web server and application logs for sudden spikes in requests to Server Action routes accompanied by sustained high CPU utilization on Node.js processes; correlate with absence of normal response times.

What your security team should do

• Immediately upgrade all Next.js installations to 15.5.28 or 16.4.1
• Monitor application CPU and request queues for anomalous spikes
• Restrict or rate-limit access to Server Action endpoints until patched