VDB
CVE-2026-94482
CVE-2026-94482
PUBLISHED
CVSS 8.2 HIGH
Reported by GitHub_M · Published October 22, 2026
Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.
EPSS 0.37% · 30.1th percentile
Risk Scores
CVSS 4.0
8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.37%
30.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| vercel | next.js | >= 13.0.0, < 15.5.28, >= 16.0.0, < 16.4.1 |
| vercel | next.js | >= 13.0.0, < 15.5.28, >= 16.0.0, < 16.4.1 |
| wolfi | jitsucom-jitsu | 0 |
| npm | next | 16.0.0, 13.0.0 |
| chainguard | homepage | 0 |
| chainguard | peerdb-ui | 0 |
| chainguard | keep-fips | 0 |
| chainguard | keep | 0 |
| chainguard | jitsucom-jitsu | 0 |
Timeline
- Oct 22, 2026 CVE Published
- Oct 22, 2026 Coalition ESS Score
- Oct 22, 2026 CVE Updated
- Oct 23, 2026 EPSS Score
- Oct 23, 2026 Security Advisory
- Oct 25, 2026 EPSS Score
References
- https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r x_refsource_CONFIRM
- https://github.com/vercel/next.js/releases/tag/v15.5.28 x_refsource_MISC
- https://github.com/vercel/next.js/releases/tag/v16.4.1 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-94482 advisory
- https://github.com/advisories/GHSA-p3m5-59mp-jv5r advisory