CVE-2026-94482

A flaw was found in Next.js. A remote attacker can exploit this vulnerability by sending specially crafted requests to applications using the App Router feature configured with Server Actions. This issue leads to excessive CPU consumption, causing a Denial of Service (DoS) that prevents the affected server process from handling subsequent requests.

This vulnerability is classified as having an Important impact because an unauthenticated remote attacker can trigger severe resource starvation and completely disrupt service availability without prior privileges. In Red Hat environments utilizing Next.js, exploitation requires the target web service to implement the App Router architecture with at least one Server Action defined. Deployments relying exclusively on the Pages Router or those running App Router without Server Actions remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.