---
id: CVE-2026-64641
title: >-
  next: Next.js: Denial of Service via crafted requests to App Router with
  Server Actions (CVE-2026-64641)
summary: >-
  A flaw was found in Next.js, a React framework for building web applications.
  A remote attacker can send specially crafted requests to Next.js applications
  that utilize the App Router with Server Actions. This can lead to excessive
  CPU usa…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-770
  - CWE-834
vendor: Red Hat
product: Red Hat Enterprise Linux AI (RHEL AI) 3
affected:
  - build_of_keycloak
  - ceph_storage 5
  - ceph_storage 6
  - ceph_storage 7
  - ceph_storage 8
  - ceph_storage 9
  - enterprise_linux_ai_rhel_ai 3
  - jboss_enterprise_application_platform 7
  - single_sign_on 7
  - streams_for_apache_kafka 2
  - streams_for_apache_kafka 3.2.1
patched:
  - streams_for_apache_kafka 3.2.1
published: '2026-07-27'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T07:59:16+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64641.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64641.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64641'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507613'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64641'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64641'
  - url: >-
      https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12
  - url: 'https://github.com/vercel/next.js/pull/96013'
  - url: 'https://github.com/vercel/next.js/releases/tag/v15.5.21'
  - url: 'https://github.com/vercel/next.js/releases/tag/v16.2.11'
  - url: 'https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj'
  - url: 'https://access.redhat.com/errata/RHSA-2026:54435'
  - url: 'https://github.com/advisories/GHSA-m99w-x7hq-7vfj'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
epss: 0.00856
epssPercentile: 0.58179
aliases:
  - GHSA-m99w-x7hq-7vfj
ecosystem: npm
ingestedAt: '2026-07-22T23:07:32.308Z'
---

## Overview

A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usage, causing the application to become unresponsive and preventing it from processing further requests, resulting in a Denial of Service (DoS).

## Vendor advisories

- **RHSA-2026:54435** · Red Hat · fixed in: Streams for Apache Kafka 3.2.1 · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54435)
- **Red Hat VEX** · Important · affected: Red Hat Build of Keycloak, Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, … · no fix planned: Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64641.json)

**next: Next.js: Denial of Service via crafted requests to App Router with Server Actions** — rated Important by Red Hat. Released 2026-07-27, updated 2026-10-21.

Affected:

- Red Hat Build of Keycloak
- Red Hat Ceph Storage 5
- Red Hat Ceph Storage 6
- Red Hat Ceph Storage 7
- Red Hat Ceph Storage 8
- Red Hat Ceph Storage 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat Single Sign-On 7
- streams for Apache Kafka 2

Fixed:

- Streams for Apache Kafka 3.2.1

No fix planned:

- Red Hat Ceph Storage 5
- Red Hat Ceph Storage 6
- Red Hat Ceph Storage 7
- Red Hat Ceph Storage 8
- Red Hat Ceph Storage 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat Single Sign-On 7
- Red Hat Build of Keycloak
- streams for Apache Kafka 2

Not affected:

- Cryostat 4
- Red Hat 3scale API Management Platform 2
- Red Hat AMQ Broker 7
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 3
- Red Hat build of Quarkus
- Red Hat Connectivity Link 1
- Red Hat Data Grid 8

## Remediation

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54435

## Package advisory (CVE-2026-64641)

Affected packages:

- `next >= 13.0.0, < 15.5.21`
- `next >= 16.0.0, < 16.2.11`

Patched in:

- `next 15.5.21`
- `next 16.2.11`

Source: https://github.com/advisories/GHSA-m99w-x7hq-7vfj