Vercel Next.js denial of service through excessive CPU use in App Router Server Actions

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.

• Vercel Next.js in the >= 13.0.0, < 15.5.28 branch is marked affected when the application uses the App Router and has at least one Server Action. The advisory describes the corresponding scope as 13.0.0 through 15.5.27.
• Vercel Next.js in the >= 16.0.0, < 16.4.1 branch is marked affected under the same deployment condition. The advisory describes the corresponding scope as 16.0.0 through 16.4.0.
• The record identifies 15.5.28 and 16.4.1 as the fixed versions for the two affected branches.
• Applications using the Pages Router and App Router applications without Server Actions are stated to be unaffected. The status of unlisted branches or deployment variants remains unestablished.

Vercel Next.js processes attacker-controlled requests in applications that use the App Router and have at least one Server Action. A crafted request can cause excessive CPU consumption and block further requests handled by the same process. This is an allocation of resources without limits or throttling, classified as CWE-770. The record establishes network reachability with no prior privileges or user interaction required, but it does not disclose the vulnerable function, parser, request field, payload shape, or specific CPU loop. Applications using the Pages Router and App Router applications without Server Actions are outside the affected scope stated by the advisory.

The flaw can be triggered remotely over the network with crafted requests. No authentication or special privileges are required, no user interaction is required, and the attack complexity is rated low. The required deployment condition is an application that uses the App Router and has at least one Server Action. The record does not provide a specific endpoint, payload structure, or exploit sequence. Exploitation in the wild, a public exploit, and a ransomware campaign are not established by the available record.

The technical impact is denial of service caused by excessive CPU consumption in a Next.js process when it handles a crafted request. The affected process may stop handling other requests in that same process, reducing service availability. The supplied impact data does not establish an effect on confidentiality or integrity, nor does it establish direct impact to subsequent systems. However, an unavailable service may have broader operational consequences depending on the application's deployment and traffic distribution.

• The primary operational consequence is degradation or loss of service availability in the affected application process.
• When the process is consumed by excessive CPU use, further requests handled by that process may be delayed or blocked, disrupting the functions it serves.
• The available data establishes an availability impact but does not establish unauthorized data access or modification.
• The record does not establish a specific data breach scenario, named victim, or attack campaign.

1. For the affected >= 13.0.0, < 15.5.28 branch, upgrade to 15.5.28.
2. For the affected >= 16.0.0, < 16.4.1 branch, upgrade to 16.4.1.
3. The advisory states that no workaround exists besides upgrading. Do not treat an application configuration change as a confirmed remediation.
4. Inventory all services, build artifacts, containers, and running processes to avoid missing deployments that use the App Router with Server Actions. If relying on the Pages Router or the absence of Server Actions for an unaffected classification, verify the actual deployment configuration before reaching that conclusion.

1. Inventory the installed next package version in manifests, lockfiles, build artifacts, container images, and running environments.
2. Identify which applications use the App Router and which applications contain at least one Server Action. This is the required condition for determining exposure.
3. Review process telemetry for unexplained sustained CPU consumption combined with the process failing to handle subsequent requests. Treat this as precautionary monitoring, not as a confirmed indicator of compromise.
4. After updating, verify the package version in the deployed artifact and confirm that the process continues handling requests normally. Do not treat the absence of error logs as proof that a system is safe.