Next.js Framework 13.x / 14.x / 15.x < 15.5.28 / 16.x < 16.4.1 Server Actions DoS (GHSA-p3m5-59mp-jv5r)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(373651);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/02");

  script_cve_id("CVE-2026-94482");
  script_xref(name:"IAVA", value:"2026-A-1205");

  script_name(english:"Next.js Framework 13.x / 14.x / 15.x < 15.5.28 / 16.x < 16.4.1 Server Actions DoS (GHSA-p3m5-59mp-jv5r)");

  script_set_attribute(attribute:"synopsis", value:
"The Next.js Framework on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Next.js Framework on the remote host is affected by a denial of service vulnerability:

  - A denial of service vulnerability exists in Next.js applications using the App Router with at least one
    Server Action. Crafted requests targeting such an application can cause excessive CPU consumption, which
    blocks the processing of further requests in the same process. Applications using the Pages Router, and
    App Router applications that do not use Server Actions, are not affected. (CVE-2026-94482)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6eae8f65");
  script_set_attribute(attribute:"see_also", value:"https://github.com/vercel/next.js/releases/tag/v15.5.28");
  script_set_attribute(attribute:"see_also", value:"https://github.com/vercel/next.js/releases/tag/v16.4.1");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Next.js Framework version 15.5.28 / 16.4.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-94482");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(770);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vercel:next.js");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

get_kb_item_or_exit('Host/nodejs/modules/enumerated');

# handle canary builds, e.g. 16.4.0-canary.12
vcf::add_separator('-');
vcf::add_conversions({'canary':-25});

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'next');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'next');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  {'min_version':'13.0.0', 'fixed_version':'15.5.28'},
  {'min_version':'16.0.0', 'fixed_version':'16.4.1'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);