Critical Alert: CVE-2026-94482 Discovered — Impact, Risks, & How to Patch It Fast

Executive Summary

Affected Software: Next.js, Severity: High

A crafted request targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage, blocking processing of further requests in the same process. This vulnerability allows an attacker to consume system resources, potentially causing denial-of-service (DoS) or slowing down the application.

Technical Impact & Vector

Crafted requests targeting Next.js applications using App Router with at least one Server Action can cause excessive CPU usage, blocking processing of further requests in the same process. This is achieved by triggering the server-side rendering (SSR) of the Next.js application, which can lead to a denial-of-service (DoS) or slow down the application.

Remediation & Patch Instructions

To remediate this vulnerability, upgrade to the latest version of Next.js. For npm-based projects, run the command npm update next. For yarn-based projects, run the command yarn upgrade next.

Applications using Pages Router or not using Server Actions are not vulnerable and do not require an update.

Official Reference: Read the full vulnerability breakdown and advisory details directly on the National Vulnerability Database (CVE-2026-94482).