CVE-2026-94482

{
  "etk_id": "ETK-2026-1831",
  "cve_id": "CVE-2026-94482",
  "display_id": "CVE-2026-94482",
  "ghsa_id": "GHSA-p3m5-59mp-jv5r",
  "euvd_id": "EUVD-2026-108214",
  "status": "published",
  "anchor_state": "anchored",
  "title": "CPU exhaustion denial of service in Next.js Server Actions",
  "summary": "Next.js App Router applications with one or more Server Actions are affected from version 13.0.0 until the fixed releases. A remote attacker can send malicious requests that consume process CPU capacity and prevent that process from serving additional requests; Pages Router deployments and App Router deployments without Server Actions are not affected.",
  "mitigation": "Upgrade Next.js to 15.5.28 or 16.4.1, as appropriate for the release line in use. If an immediate upgrade cannot be completed, reduce exposure by disabling or avoiding Server Actions where feasible.",
  "vendor": "npm",
  "product": "npm:next",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 13.0.0, <= 15.5.27"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "15.5.28"
      ],
      "package_name": "next",
      "purl": "pkg:npm/next"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 16.0.0, <= 16.4.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "16.4.1"
      ],
      "package_name": "next",
      "purl": "pkg:npm/next"
    }
  ],
  "cwes": null,
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 23.502883783333335,
  "t0_at": "2026-10-22T15:22:10.155000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T17:47:43+00:00",
      "days": -7.8989254050925926,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T15:22:10.155000+00:00",
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r"
    }
  }
}