{"id":"CVE-2026-64641","title":"next: Next.js: Denial of Service via crafted requests to App Router with Server Actions (CVE-2026-64641)","summary":"A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usa…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-770","CWE-834"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","affected":["build_of_keycloak","ceph_storage 5","ceph_storage 6","ceph_storage 7","ceph_storage 8","ceph_storage 9","enterprise_linux_ai_rhel_ai 3","jboss_enterprise_application_platform 7","single_sign_on 7","streams_for_apache_kafka 2","streams_for_apache_kafka 3.2.1"],"patched":["streams_for_apache_kafka 3.2.1"],"published":"2026-07-27","updated":"2026-10-21","sourceUpdated":"2026-10-21T07:59:16+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64641.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64641.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64641"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507613"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64641"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64641"},{"url":"https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12"},{"url":"https://github.com/vercel/next.js/pull/96013"},{"url":"https://github.com/vercel/next.js/releases/tag/v15.5.21"},{"url":"https://github.com/vercel/next.js/releases/tag/v16.2.11"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj"},{"url":"https://access.redhat.com/errata/RHSA-2026:54435"},{"url":"https://github.com/advisories/GHSA-m99w-x7hq-7vfj"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00856,"epssPercentile":0.58179,"aliases":["GHSA-m99w-x7hq-7vfj"],"ecosystem":"npm","ingestedAt":"2026-07-22T23:07:32.308Z","slug":"CVE-2026-64641","body":"## Overview\n\nA flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usage, causing the application to become unresponsive and preventing it from processing further requests, resulting in a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **RHSA-2026:54435** · Red Hat · fixed in: Streams for Apache Kafka 3.2.1 · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54435)\n- **Red Hat VEX** · Important · affected: Red Hat Build of Keycloak, Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, … · no fix planned: Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64641.json)\n\n**next: Next.js: Denial of Service via crafted requests to App Router with Server Actions** — rated Important by Red Hat. Released 2026-07-27, updated 2026-10-21.\n\nAffected:\n\n- Red Hat Build of Keycloak\n- Red Hat Ceph Storage 5\n- Red Hat Ceph Storage 6\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat Single Sign-On 7\n- streams for Apache Kafka 2\n\nFixed:\n\n- Streams for Apache Kafka 3.2.1\n\nNo fix planned:\n\n- Red Hat Ceph Storage 5\n- Red Hat Ceph Storage 6\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat Single Sign-On 7\n- Red Hat Build of Keycloak\n- streams for Apache Kafka 2\n\nNot affected:\n\n- Cryostat 4\n- Red Hat 3scale API Management Platform 2\n- Red Hat AMQ Broker 7\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat build of Apicurio Registry 3\n- Red Hat build of Quarkus\n- Red Hat Connectivity Link 1\n- Red Hat Data Grid 8\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54435\n\n## Package advisory (CVE-2026-64641)\n\nAffected packages:\n\n- `next >= 13.0.0, < 15.5.21`\n- `next >= 16.0.0, < 16.2.11`\n\nPatched in:\n\n- `next 15.5.21`\n- `next 16.2.11`\n\nSource: https://github.com/advisories/GHSA-m99w-x7hq-7vfj","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[{"seq":217231,"id":"CVE-2026-64641","ts":1791360787668,"field":"cvss","old":null,"new":"7.5"}]}