GHSA-P3M5-59MP-JV5R Next.js: Denial of Service in App Router using Server Actions

Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using...

Next.js: Denial of Service in App Router using Server Actions

Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using...

EUVD-2026-108214

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process...

CVE-2026-94482 Next.js: Denial of Service in App Router using Server Actions

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process...

CVE-2026-94482

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process...

CVE-2026-94482 Next.js: Denial of Service in App Router using Server Actions

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process...

CVE-2026-94482

The Next.js React framework is vulnerable to a Denial of Service (DoS) condition in versions 13.0.0 through 15.5.28 and 16.4.1 . The issue affects applications utilizing the App Router with at least one Server Action . Specifically, crafted requests can trigger excessive CPU consumption , which b...

Exploit for Deserialization of Untrusted Data in Facebook React

websiteScanner A passive, non-intrusive scanner that tells yo...

Red Hat: CVE-2026-94482: next: Next.js: Denial of Service via crafted requests targeting Server Actions

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process...

Linux Distros Unpatched Vulnerability : CVE-2026-94482

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications...

PT-2026-121419

Name of the Vulnerable Software and Affected Versions Next.js versions 13.0.0 through 15.5.27 Next.js versions 16.0.0 through 16.4.0 Description Crafted requests targeting App Router applications that implement at least one Server Action can cause excessive CPU consumption. This resource exhausti...

Vercel Next.js resource management error vulnerability

Versions 13.0.0 through 15.5.28 and 16.0.0 through 16.4.1 of Vercel Next.js contain a resource management error vulnerability. This vulnerability arises from specially crafted requests directed at App Router applications that include at least one Server Action; it may lead to excessive CPU...

Marcos Penelas Cámara Next.js Ecommerce Template Input validation error vulnerability

The Marcos Penelas Cámara Next.js Ecommerce Template contains an input validation error vulnerability. This vulnerability arises because external control assumes that web parameters are immutable in the shopping cart and checkout processes. The POST /api/user/cart endpoint accepts two independent...

Marcos Penelas Cámara Next.js Ecommerce Template authorization issue vulnerability

The Marcos Penelas Cámara Next.js Ecommerce Template contains an authorization bypass vulnerability. This vulnerability arises from unauthorized access to user-controlled keys; shopping cart and wishlist operations rely solely on primary key matching without verifying the associated user...

React2Shell-CVE-2025-55182

HackIndex.IO - React2Shell - CVE-2025-55182 + CVE-2025-66478 A HackIndex.io sandbox environment for the React2Shell vulnerability. This will start a web app on port 3000, and a SSH server on port 2222. Start the environment docker compose up --build --force-recreate SSH Web admin Port 2222 webadm...

Next.js-RCE-Scanner---CVE-2025-55182-CVE-2025-66478

🔍 Next.js RCE Scanner - CVE-2025-55182 & CVE-2025-66478 A powerful and easy-to-use scanner for detecting critical RCE vulnerabilities in Next.js applications 🎯 Overview An advanced vulnerability scanner for detecting CVE-2025-55182 and CVE-2025-66478 - critical Remote Code Execution RCE...

Exploit for CVE-2026-96889

CVE-2026-96889 — Image Optimization SVG → librsvg use-after-fr...

Next.js 16.4.0 Image Optimization Remote Code Execution

Next.js versions through 15.5.27 and 16.0.1 through 16.4.0 contain an unauthenticated remote code execution vulnerability in Image Optimization when crafted SVG content is processed by vulnerable sharp and librsvg builds. https://packetstorm.news/download/236044...

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library...

Next.js Path Traversal

The vulnerability of the Next.js web application development software platform is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...