CVE-2026-64641

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12	Patch
https://github.com/vercel/next.js/pull/96013	Issue Tracking Patch
https://github.com/vercel/next.js/releases/tag/v15.5.21	Product Release Notes
https://github.com/vercel/next.js/releases/tag/v16.2.11	Product Release Notes
https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vercel:next.js::::::node.js::*
	cpe:2.3:a:vercel:next.js::::::node.js::*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Next.js es un framework de React para construir aplicaciones web full-stack. En las versiones 13.0.0 hasta la 15.5.20 y 16.0.0 hasta la 16.2.10, solicitudes elaboradas dirigidas a aplicaciones Next.js que usan App Router con al menos una Server Action pueden llevar a un uso excesivo de CPU bloqueando el procesamiento de solicitudes adicionales en el mismo proceso. Este problema ha sido solucionado en las versiones 15.5.21 y 16.2.11.

Information

Published : 2026-07-27 18:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-64641

Mitre link : CVE-2026-64641

CVE.ORG link : CVE-2026-64641

JSON object : View

Products Affected

vercel

next.js

CWE

CWE-834

Excessive Iteration

{"id": "CVE-2026-64641", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64641", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T18:54:52.018065Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "vercel", "product": "next.js", "versions": [{"status": "affected", "version": ">= 13.0.0, < 15.5.21"}, {"status": "affected", "version": ">= 16.0.0, < 16.2.11"}]}]}], "published": "2026-07-27T18:16:58.850", "references": [{"url": "https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vercel/next.js/pull/96013", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vercel/next.js/releases/tag/v15.5.21", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vercel/next.js/releases/tag/v16.2.11", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-834"}]}], "descriptions": [{"lang": "en", "value": "Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11."}, {"lang": "es", "value": "Next.js es un framework de React para construir aplicaciones web full-stack. En las versiones 13.0.0 hasta la 15.5.20 y 16.0.0 hasta la 16.2.10, solicitudes elaboradas dirigidas a aplicaciones Next.js que usan App Router con al menos una Server Action pueden llevar a un uso excesivo de CPU bloqueando el procesamiento de solicitudes adicionales en el mismo proceso. Este problema ha sido solucionado en las versiones 15.5.21 y 16.2.11."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "A35AD882-35BE-4B3B-8BBC-11ED8E8E1336", "versionEndExcluding": "15.5.21", "versionStartIncluding": "13.0.0"}, {"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "841758BF-9324-4127-B087-6A8C1BADB389", "versionEndExcluding": "16.2.11", "versionStartIncluding": "16.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}