next: Next.js: Denial of Service via crafted requests to App Router with Server Actions (CVE-2026-64641)

Overview

A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usage, causing the application to become unresponsive and preventing it from processing further requests, resulting in a Denial of Service (DoS).

Vendor advisories

• RHSA-2026:54435 · Red Hat · fixed in: Streams for Apache Kafka 3.2.1 · released 2026-08-12 · advisory
• Red Hat VEX · Important · affected: Red Hat Build of Keycloak, Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, … · no fix planned: Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, … · updated 2026-10-21 · vex

next: Next.js: Denial of Service via crafted requests to App Router with Server Actions — rated Important by Red Hat. Released 2026-07-27, updated 2026-10-21.

Affected:

• Red Hat Build of Keycloak
• Red Hat Ceph Storage 5
• Red Hat Ceph Storage 6
• Red Hat Ceph Storage 7
• Red Hat Ceph Storage 8
• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat JBoss Enterprise Application Platform 7
• Red Hat Single Sign-On 7
• streams for Apache Kafka 2

Fixed:

• Streams for Apache Kafka 3.2.1

No fix planned:

• Red Hat Ceph Storage 5
• Red Hat Ceph Storage 6
• Red Hat Ceph Storage 7
• Red Hat Ceph Storage 8
• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat JBoss Enterprise Application Platform 7
• Red Hat Single Sign-On 7
• Red Hat Build of Keycloak
• streams for Apache Kafka 2

Not affected:

• Cryostat 4
• Red Hat 3scale API Management Platform 2
• Red Hat AMQ Broker 7
• Red Hat build of Apache Camel - HawtIO 4
• Red Hat build of Apache Camel 4 for Quarkus 3
• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat build of Apicurio Registry 3
• Red Hat build of Quarkus
• Red Hat Connectivity Link 1
• Red Hat Data Grid 8

Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54435

Package advisory (CVE-2026-64641)

Affected packages:

• next >= 13.0.0, < 15.5.21
• next >= 16.0.0, < 16.2.11

Patched in:

• next 15.5.21
• next 16.2.11

Source: https://github.com/advisories/GHSA-m99w-x7hq-7vfj