CVE-2026-94482: the Next.js Server Actions denial of service, who is affected and the fix

What CVE-2026-94482 is, in plain words

A Server Action is a function marked "use server" that your pages call from a form or a button. On the network, each call is a POST request to your app, which the server decodes before it runs your code. Anyone can send one, as the Next.js security guide explains.

CVE-2026-94482 is a flaw in how Next.js handles those requests. Per the advisory, crafted requests to an App Router app with at least one Server Action cause "excessive CPU usage blocking processing of further requests in the same process." Per the CVSS vector, no login and no click from a user are needed. The weakness class is CWE-770, allocation of resources without limits or throttling.

The Next.js release post links it to an upstream React advisory, GHSA-h3gv-c5rc-p453, fixed the same day. Neither advisory describes the mechanism, and neither does this page.

What a stranger can and cannot do

• Stall your server. Node.js runs your JavaScript on one thread per process, so while it burns CPU on a crafted request, every other visitor on that process waits. With one next start process on a VPS, that is the whole site.
• Run up your bill. Netlify warns that "active exploitation could increase your function costs". Vercel bills functions by Active CPU, "the CPU time your code actively consumes".
• Nothing more. The CNA rates the impact on confidentiality and integrity as none. The code execution bugs of the same release are GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr.

Severity and exploitation status

The vector marks an attack requirement as present; the only condition the advisory states is an App Router app with a Server Action. "Automatable" means CISA judges the attack can be scripted reliably. We found no public report of exploitation, and the advisory credits no researcher.

Who is affected

Your app is exposed when all three of these are true:

1. It runs next 13.0.0 to 15.5.27, or 16.0.0 to 16.4.0.
2. It uses the App Router, the app/ directory.
3. It has at least one Server Action.

"Applications using Pages Router or not using Server Actions are not vulnerable," the advisory adds. It says nothing about hosting: on every host, the version decides.

On Next.js 13, Server Actions need experimental.serverActions: true; Next.js 14 made them stable and on by default.

How to check your Next.js version

Check the version your lockfile resolves, not the range in package.json: "next": "^16.2.0" can still be pinned to 16.2.11 in the lockfile. Run one of these at the root of the project:

# What is installed
npm ls next
pnpm why next
yarn why next

# The version the Next.js CLI reports
npx next --version

Do not trust an old audit: the advisory reached the GitHub Advisory Database, which npm audit and Dependabot read, on 22 October, eight days after the fix shipped.

Does your app have a Server Action?

A file that starts with "use server" exports actions, and a function whose first line is "use server" is one. Search your code, then count what the build contains:

# In your source
grep -rlE --include='*.ts' --include='*.tsx' --include='*.js' --include='*.jsx' \
  "[\"']use server[\"']" app src lib components 2>/dev/null

# After next build: how many Server Actions the build contains
node -e "const m=require('./.next/server/server-reference-manifest.json');console.log(Object.keys(m.node).length+Object.keys(m.edge||{}).length)"

No action means this CVE does not apply today, but one new form can add one. To see whether production answers the React Server Components protocol, use the header check on the CVE-2025-55184 page.

How to fix CVE-2026-94482

1. 1

   Upgrade Next.js

   16.4.1 and 15.5.28 are the first fixed releases. Go to the latest patch instead, 16.4.5 or 15.5.29 from the November 2026 security release, which also fixes cache and cookie advisories.

2. 2

   Leave 13.x, 14.x and early 15.x

   Those lines get no fix. Moving to 15.5 or 16 is a major upgrade: read the Next.js upgrade guides first.

3. 3

   Commit the lockfile and redeploy

   Production runs what the lockfile installs. If you ship a Docker image, rebuild it without a stale install layer.

4. 4

   Other React Server Components frameworks

   Outside Next.js, update react-server-dom-webpack, -parcel or -turbopack to 19.0.9, 19.1.10, 19.2.9 or 19.3.1, the versions the upstream React advisory names. Its affected list includes 19.0.8, 19.1.9 and 19.2.8, the July fixes, so those are not enough.

# Next.js 16 (Active LTS), latest patch on 8 November 2026
npm install [email protected]

# Next.js 15 (Maintenance LTS)
npm install [email protected]

# The same with pnpm or yarn
pnpm add [email protected]
yarn add [email protected]

Rate limits and other defence in depth

A rate limit refuses requests beyond a count per source. It does not make a crafted request cheaper, and a sender with many addresses stays under it.

# In the http block
limit_req_zone $binary_remote_addr zone=app:10m rate=10r/s;

server {
  location / {
    limit_req zone=app burst=20 nodelay;
    proxy_pass http://127.0.0.1:3000;
  }
}

How it relates to the other Next.js denial of service CVEs

This is the second Next.js advisory of 2026 with exactly this title. In July, CVE-2026-64641 (GHSA-m99w-x7hq-7vfj, also 8.2 High, but CWE-834, excessive iteration) described the same symptom and was fixed in 16.2.11 and 15.5.21, two versions this CVE affects. If you patched in July and stopped, patch again.

Both follow a run of denial of service bugs in React's Server Components code, such as CVE-2025-55184 and CVE-2026-23864; the upstream React advisory above is the latest. Next.js ships its own copy of that React code, so in a Next.js app only the next version counts.

Timeline

What Keybrum checks on a live app

Keybrum never sends a denial of service payload: stalling a server to prove a point is downtime for its owner, so no Keybrum attack tests CVE-2026-94482 itself. On apps whose owner proved ownership, one ordinary request with the RSC header confirms that production answers the React Server Components protocol, and a read of your JavaScript looks for Server Action ids, signs of this advisory's two conditions. The report names the current floor, 16.4.5 or 15.5.29; your version check settles the rest.

Vibe coding security risks covers what AI-built apps leak most often.