ETK-2026-1831Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-1831",
  "cve_id": null,
  "display_id": "ETK-2026-1831",
  "ghsa_id": "GHSA-p3m5-59mp-jv5r",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Denial of service in Next.js App Router Server Actions",
  "summary": "Next.js applications using the App Router and at least one Server Action are affected. An attacker can send crafted requests that consume excessive CPU and prevent the affected process from handling further requests; applications using the Pages Router or no Server Actions are not affected.",
  "mitigation": "Upgrade the `next` package to 15.5.28 or 16.4.1. Prioritize upgrades for applications that use App Router Server Actions.",
  "vendor": "npm",
  "product": "npm:next",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=13.0.0 <= 15.5.27"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "15.5.28"
      ],
      "package_name": "next",
      "purl": "pkg:npm/next"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 16.0.0 <= 16.4.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "16.4.1"
      ],
      "package_name": "next",
      "purl": "pkg:npm/next"
    }
  ],
  "cwes": null,
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.240383266666667,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T17:47:43+00:00",
      "days": -6.500068453368056,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T05:47:48.936406+00:00",
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r"
    }
  }
}