{"id":"CVE-2026-94482","aliases":["CLSA-2026-1793100738","CLSA-2026-1793806552","CLSA-2026-1793806773","CLSA-2026-1793808642","CLSA-2026-1793809685","CLSA-2026-1793810649","CLSA-2026-1793811028","CLSA-2026-1793811416","CLSA-2026-1793812233","EUVD-2026-108214","GHSA-2464-fhr4-w9xw","GHSA-673q-mjm6-r5xr","GHSA-p3m5-59mp-jv5r","GHSA-vcvr-r3jv-pc5j","ROOT-APP-NPM-CVE-2026-94482","ROOT-APP-NPM-GHSA-2464-fhr4-w9xw","ROOT-APP-NPM-GHSA-673q-mjm6-r5xr","ROOT-APP-NPM-GHSA-vcvr-r3jv-pc5j"],"status":"published","title":"Next.js: Denial of Service in App Router using Server Actions","description":"Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00386,"percentile":0.33045,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395","CWE-502","CWE-770"],"published":"2026-09-30T14:48:30Z","modified":"2026-11-09T01:45:04Z","fixes":[{"ecosystem":"npm","package":"next","fixed_in":["15.5.28","16.4.1","16.3.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"next","fixed_in":["15.5.24-tuxcare.4","16.0.6-tuxcare.14","15.1.2-tuxcare.5","14.2.35-tuxcare.16","15.5.24-tuxcare.5","15.5.26-tuxcare.4","15.5.25-tuxcare.4","15.5.23-tuxcare.5"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/env","fixed_in":["13.5.11-tuxcare.21"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/font","fixed_in":["13.5.11-tuxcare.21"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"eslint-config-next","fixed_in":["13.5.11-tuxcare.21"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"next","fixed_in":["16.3.3-aikido.3","15.5.21-aikido.2","16.3.3-aikido.4","16.3.6-aikido.2","16.3.8-aikido.1","14.2.35-aikido.11","15.5.27-aikido.2","16.3.3-aikido.1","16.2.11-aikido.2","16.3.3-aikido.2","16.3.6-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/next","fixed_in":["16.3.3-root.io.3","15.5.21-root.io.2","16.3.3-root.io.4","16.3.6-root.io.2","16.3.8-root.io.1","14.2.35-root.io.11","15.5.27-root.io.2","16.3.3-root.io.1","16.2.11-root.io.2","16.3.3-root.io.2","16.3.6-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"last_affected":"15.5.27"},{"fixed":"15.5.28"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"last_affected":"16.4.0"},{"fixed":"16.4.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"last_affected":"16.4.0"},{"fixed":"16.4.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"last_affected":"15.5.27"},{"fixed":"15.5.28"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"last_affected":"16.4.0"},{"fixed":"16.4.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.2.0"},{"fixed":"16.3.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.4"}]}],"versions":["15.5.24","15.5.24-tuxcare.1","15.5.24-tuxcare.2","15.5.24-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.14"}]}],"versions":["16.0.6","16.0.6-tuxcare.1","16.0.6-tuxcare.10","16.0.6-tuxcare.11","16.0.6-tuxcare.12","16.0.6-tuxcare.13","16.0.6-tuxcare.2","16.0.6-tuxcare.3","16.0.6-tuxcare.4","16.0.6-tuxcare.5","16.0.6-tuxcare.6","16.0.6-tuxcare.7","16.0.6-tuxcare.8","16.0.6-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/env","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.11-tuxcare.0"},{"fixed":"13.5.11-tuxcare.21"}]}],"versions":["13.5.11","13.5.11-tuxcare.1","13.5.11-tuxcare.10","13.5.11-tuxcare.11","13.5.11-tuxcare.12","13.5.11-tuxcare.13","13.5.11-tuxcare.14","13.5.11-tuxcare.15","13.5.11-tuxcare.16","13.5.11-tuxcare.17","13.5.11-tuxcare.18","13.5.11-tuxcare.19","13.5.11-tuxcare.2","13.5.11-tuxcare.20","13.5.11-tuxcare.3","13.5.11-tuxcare.4","13.5.11-tuxcare.5","13.5.11-tuxcare.6","13.5.11-tuxcare.7","13.5.11-tuxcare.8","13.5.11-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/font","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.11-tuxcare.0"},{"fixed":"13.5.11-tuxcare.21"}]}],"versions":["13.5.11","13.5.11-tuxcare.1","13.5.11-tuxcare.10","13.5.11-tuxcare.11","13.5.11-tuxcare.12","13.5.11-tuxcare.13","13.5.11-tuxcare.14","13.5.11-tuxcare.15","13.5.11-tuxcare.16","13.5.11-tuxcare.17","13.5.11-tuxcare.18","13.5.11-tuxcare.19","13.5.11-tuxcare.2","13.5.11-tuxcare.20","13.5.11-tuxcare.3","13.5.11-tuxcare.4","13.5.11-tuxcare.5","13.5.11-tuxcare.6","13.5.11-tuxcare.7","13.5.11-tuxcare.8","13.5.11-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"eslint-config-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.11-tuxcare.0"},{"fixed":"13.5.11-tuxcare.21"}]}],"versions":["13.5.11","13.5.11-tuxcare.1","13.5.11-tuxcare.10","13.5.11-tuxcare.11","13.5.11-tuxcare.12","13.5.11-tuxcare.13","13.5.11-tuxcare.14","13.5.11-tuxcare.15","13.5.11-tuxcare.16","13.5.11-tuxcare.17","13.5.11-tuxcare.18","13.5.11-tuxcare.19","13.5.11-tuxcare.2","13.5.11-tuxcare.20","13.5.11-tuxcare.3","13.5.11-tuxcare.4","13.5.11-tuxcare.5","13.5.11-tuxcare.6","13.5.11-tuxcare.7","13.5.11-tuxcare.8","13.5.11-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.2-tuxcare.0"},{"fixed":"15.1.2-tuxcare.5"}]}],"versions":["15.1.2","15.1.2-tuxcare.1","15.1.2-tuxcare.2","15.1.2-tuxcare.3","15.1.2-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.35-tuxcare.0"},{"fixed":"14.2.35-tuxcare.16"}]}],"versions":["14.2.35","14.2.35-tuxcare.1","14.2.35-tuxcare.10","14.2.35-tuxcare.11","14.2.35-tuxcare.12","14.2.35-tuxcare.14","14.2.35-tuxcare.15","14.2.35-tuxcare.2","14.2.35-tuxcare.3","14.2.35-tuxcare.4","14.2.35-tuxcare.5","14.2.35-tuxcare.6","14.2.35-tuxcare.7","14.2.35-tuxcare.8","14.2.35-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.5"}]}],"versions":["15.5.24","15.5.24-tuxcare.1","15.5.24-tuxcare.2","15.5.24-tuxcare.3","15.5.24-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.4"}]}],"versions":["15.5.26","15.5.26-tuxcare.1","15.5.26-tuxcare.2","15.5.26-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.4"}]}],"versions":["15.5.25","15.5.25-tuxcare.1","15.5.25-tuxcare.2","15.5.25-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.5"}]}],"versions":["15.5.23","15.5.23-tuxcare.1","15.5.23-tuxcare.2","15.5.23-tuxcare.3","15.5.23-tuxcare.4"]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"15.5.28"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.4.1"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.4.1"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"15.5.28"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.4.1"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.2.0"},{"fixed":"16.3.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.3.3-aikido.3"},{"fixed":"15.5.21-aikido.2"},{"fixed":"16.3.3-aikido.4"},{"fixed":"16.3.6-aikido.2"},{"fixed":"16.3.8-aikido.1"},{"fixed":"14.2.35-aikido.11"},{"fixed":"15.5.27-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.3.3-root.io.3"},{"fixed":"15.5.21-root.io.2"},{"fixed":"16.3.3-root.io.4"},{"fixed":"16.3.6-root.io.2"},{"fixed":"16.3.8-root.io.1"},{"fixed":"14.2.35-root.io.11"},{"fixed":"15.5.27-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.3.3-aikido.3"},{"fixed":"15.5.21-aikido.2"},{"fixed":"16.3.3-aikido.4"},{"fixed":"16.3.6-aikido.2"},{"fixed":"16.3.8-aikido.1"},{"fixed":"14.2.35-aikido.11"},{"fixed":"15.5.27-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.3.3-root.io.3"},{"fixed":"15.5.21-root.io.2"},{"fixed":"16.3.3-root.io.4"},{"fixed":"16.3.6-root.io.2"},{"fixed":"16.3.8-root.io.1"},{"fixed":"14.2.35-root.io.11"},{"fixed":"15.5.27-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.3.3-aikido.4"},{"fixed":"16.3.6-aikido.2"},{"fixed":"16.3.8-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.3.3-root.io.4"},{"fixed":"16.3.6-root.io.2"},{"fixed":"16.3.8-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.3.3-aikido.1"},{"fixed":"16.2.11-aikido.2"},{"fixed":"16.3.3-aikido.2"},{"fixed":"16.3.3-aikido.3"},{"fixed":"16.3.3-aikido.4"},{"fixed":"16.3.6-aikido.1"},{"fixed":"16.3.6-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.3.3-root.io.1"},{"fixed":"16.2.11-root.io.2"},{"fixed":"16.3.3-root.io.2"},{"fixed":"16.3.3-root.io.3"},{"fixed":"16.3.3-root.io.4"},{"fixed":"16.3.6-root.io.1"},{"fixed":"16.3.6-root.io.2"}]}]}],"products":[{"vendor":"vercel","product":"next.js"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/vercel/next.js/releases/tag/v15.5.28","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/vercel/next.js/releases/tag/v16.4.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96889","tags":["advisory"]},{"url":"https://github.com/vercel/next.js/commit/5e3b687b5edb868b064bdc058d768a7021e7f6ad","tags":["web"]},{"url":"https://github.com/vercel/next.js/commit/9571ec899f063df6533351bec390ccb2cc0af6a3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2464-fhr4-w9xw"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr","tags":["web"]},{"url":"https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f","tags":["web"]},{"url":"https://github.com/advisories/GHSA-673q-mjm6-r5xr"},{"url":"https://github.com/advisories/GHSA-p3m5-59mp-jv5r"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j","tags":["web"]},{"url":"https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp","tags":["web"]},{"url":"https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e","tags":["web"]},{"url":"https://github.com/vercel/next.js/releases/tag/v16.3.6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vcvr-r3jv-pc5j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94482.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94482","tags":["advisory"]},{"url":"https://github.com/vercel/next.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-94482","title":"Next.js: Denial of Service in App Router using Server Actions","description":"Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.","status":"published","published":"2026-10-22T15:22:10.155Z","modified":"2026-10-30T18:09:28.569Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-108214","description":"Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.","status":"published","published":"2026-10-22T15:22:10Z","modified":"2026-10-30T18:09:28Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:59:03.071815Z"}],"ghsa":[{"id":"GHSA-2464-fhr4-w9xw","title":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used","description":"## Impact\n\nA memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.\n\n## Workaround\n\nEnsure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`.\nUpgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.","status":"published","published":"2026-10-22T15:52:53Z","modified":"2026-10-22T15:52:56Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T14:41:34.690842Z"},{"id":"GHSA-673q-mjm6-r5xr","title":"Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays","description":"## Impact\n\nA vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.\n\n## Workaround\n\nThere is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.","status":"published","published":"2026-10-22T16:42:31Z","modified":"2026-10-22T16:42:32Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:41:34.690842Z"},{"id":"GHSA-p3m5-59mp-jv5r","title":"Next.js: Denial of Service in App Router using Server Actions","description":"## Impact\n\nCrafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.\n\n## Workarounds\n\nNo workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.","status":"published","published":"2026-10-22T15:50:34Z","modified":"2026-10-22T15:50:35Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:41:34.690842Z"},{"id":"GHSA-vcvr-r3jv-pc5j","title":"Next.js: Remote Code Execution in next/og ImageResponse","description":"## Impact\n\nThe Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability. This can lead to remote code execution.\n\nAffected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:\n\n```tsx\nimport { ImageResponse } from 'next/og'\n\nexport async function GET(request: Request) {\n  const value = new URL(request.url).searchParams.get('value') ?? ''\n\n  return new ImageResponse(\n    \u003csvg width=\"1200\" height=\"630\"\u003e\n      \u003ctitle\u003e{value}\u003c/title\u003e\n    \u003c/svg\u003e\n  )\n}\n```\n\nApplications using the Edge `ImageResponse` implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.\n\n## Workaround\n\nIf upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js `ImageResponse` implementation from `next/og`.","status":"published","published":"2026-09-30T14:48:30Z","modified":"2026-09-30T14:48:31Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-94482","description":"Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.","status":"published","published":"2026-10-22T16:19:16.72Z","modified":"2026-10-30T19:20:19.39Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:13:02.724605Z"}],"osv":[{"id":"CVE-2026-94482","title":"Next.js: Denial of Service in App Router using Server Actions","description":"Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.","status":"published","published":"2026-10-22T15:22:10.155Z","modified":"2026-11-01T02:30:35.199516866Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:20.931171Z"},{"id":"GHSA-2464-fhr4-w9xw","title":"Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used","description":"## Impact\n\nA memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.\n\n## Workaround\n\nEnsure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`.\nUpgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.","status":"published","published":"2026-10-22T15:52:53Z","modified":"2026-10-22T16:00:09.125335909Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"GHSA-673q-mjm6-r5xr","title":"Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays","description":"## Impact\n\nA vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.\n\n## Workaround\n\nThere is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.","status":"published","published":"2026-10-22T16:42:31Z","modified":"2026-10-22T17:00:04.201859111Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"GHSA-p3m5-59mp-jv5r","title":"Next.js: Denial of Service in App Router using Server Actions","description":"## Impact\n\nCrafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.\n\n## Workarounds\n\nNo workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.","status":"published","published":"2026-10-22T15:50:34Z","modified":"2026-10-22T16:00:09.130954454Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"GHSA-vcvr-r3jv-pc5j","title":"Next.js: Remote Code Execution in next/og ImageResponse","description":"## Impact\n\nThe Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability. This can lead to remote code execution.\n\nAffected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:\n\n```tsx\nimport { ImageResponse } from 'next/og'\n\nexport async function GET(request: Request) {\n  const value = new URL(request.url).searchParams.get('value') ?? ''\n\n  return new ImageResponse(\n    \u003csvg width=\"1200\" height=\"630\"\u003e\n      \u003ctitle\u003e{value}\u003c/title\u003e\n    \u003c/svg\u003e\n  )\n}\n```\n\nApplications using the Edge `ImageResponse` implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.\n\n## Workaround\n\nIf upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js `ImageResponse` implementation from `next/og`.","status":"published","published":"2026-09-30T14:48:30Z","modified":"2026-10-01T03:56:48.683494153Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"CLSA-2026-1793100738","title":"TuxCare security update for next (1 CVE)","description":"TuxCare rebuilt next to address 1 CVE. Fixed in 15.5.24-tuxcare.4.","status":"published","published":"2026-10-27T11:32:17Z","modified":"2026-10-30T19:46:06.452006485Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793806552","title":"TuxCare security update for next (4 CVEs)","description":"TuxCare rebuilt next to address 4 CVEs. Fixed in 16.0.6-tuxcare.14.","status":"published","published":"2026-11-04T16:35:53Z","modified":"2026-11-04T19:00:39.148685462Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"CLSA-2026-1793806773","title":"TuxCare security update for 3 packages (1 CVE)","description":"TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 13.5.11-tuxcare.21.","status":"published","published":"2026-11-04T16:39:34Z","modified":"2026-11-09T01:45:04.373164007Z","updated_at":"2026-11-09T02:15:19.582074Z"},{"id":"CLSA-2026-1793808642","title":"TuxCare security update for next (2 CVEs)","description":"TuxCare rebuilt next to address 2 CVEs. Fixed in 15.1.2-tuxcare.5.","status":"published","published":"2026-11-04T17:10:43Z","modified":"2026-11-04T19:00:38.242465228Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"CLSA-2026-1793809685","title":"TuxCare security update for next (1 CVE)","description":"TuxCare rebuilt next to address 1 CVE. Fixed in 14.2.35-tuxcare.16.","status":"published","published":"2026-11-04T17:28:06Z","modified":"2026-11-04T19:00:35.35772118Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"CLSA-2026-1793810649","title":"TuxCare security update for next (1 CVE)","description":"TuxCare rebuilt next to address 1 CVE. Fixed in 15.5.24-tuxcare.5.","status":"published","published":"2026-11-04T17:44:10Z","modified":"2026-11-04T19:00:39.155280616Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"CLSA-2026-1793811028","title":"TuxCare security update for next (1 CVE)","description":"TuxCare rebuilt next to address 1 CVE. Fixed in 15.5.26-tuxcare.4.","status":"published","published":"2026-11-04T17:50:29Z","modified":"2026-11-04T19:00:35.341875993Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"CLSA-2026-1793811416","title":"TuxCare security update for next (2 CVEs)","description":"TuxCare rebuilt next to address 2 CVEs. Fixed in 15.5.25-tuxcare.4.","status":"published","published":"2026-11-04T17:56:57Z","modified":"2026-11-04T19:00:37.203108197Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"CLSA-2026-1793812233","title":"TuxCare security update for next (2 CVEs)","description":"TuxCare rebuilt next to address 2 CVEs. Fixed in 15.5.23-tuxcare.5.","status":"published","published":"2026-11-04T18:10:34Z","modified":"2026-11-04T19:00:40.113033408Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"ROOT-APP-NPM-CVE-2026-94482","title":"CVE-2026-94482 in next - Patched by Root","description":"Root has patched CVE-2026-94482 in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-02T11:22:46Z","modified":"2026-11-02T12:15:04.632587114Z","updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"ROOT-APP-NPM-GHSA-2464-fhr4-w9xw","title":"GHSA-2464-fhr4-w9xw in next - Patched by Root","description":"Root has patched GHSA-2464-fhr4-w9xw in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-02T11:22:46Z","modified":"2026-11-02T12:15:04.653426254Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-673q-mjm6-r5xr","title":"GHSA-673q-mjm6-r5xr in next - Patched by Root","description":"Root has patched GHSA-673q-mjm6-r5xr in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-30T13:03:23Z","modified":"2026-10-30T14:15:02.837966078Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-vcvr-r3jv-pc5j","title":"GHSA-vcvr-r3jv-pc5j in next - Patched by Root","description":"Root has patched GHSA-vcvr-r3jv-pc5j in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-30T11:22:04Z","modified":"2026-10-30T12:16:16.690271326Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}