Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.
References
| Link | Resource |
|---|---|
| https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12 | Patch |
| https://github.com/vercel/next.js/pull/96013 | Issue Tracking Patch |
| https://github.com/vercel/next.js/releases/tag/v15.5.21 | Product Release Notes |
| https://github.com/vercel/next.js/releases/tag/v16.2.11 | Product Release Notes |
| https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
29 Jul 2026, 14:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12 - Patch | |
| References | () https://github.com/vercel/next.js/pull/96013 - Issue Tracking, Patch | |
| References | () https://github.com/vercel/next.js/releases/tag/v15.5.21 - Product, Release Notes | |
| References | () https://github.com/vercel/next.js/releases/tag/v16.2.11 - Product, Release Notes | |
| References | () https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj - Vendor Advisory | |
| CPE | cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Vercel
Vercel next.js |
27 Jul 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-27 18:16
Updated : 2026-07-29 14:36
NVD link : CVE-2026-64641
Mitre link : CVE-2026-64641
CVE.ORG link : CVE-2026-64641
JSON object : View
Products Affected
vercel
- next.js
CWE
CWE-834
Excessive Iteration