AIKIDO-2026-104277
next is vulnerable to Denial of Service
82
High Risk
This Affects:
nextTL;DR
Crafted requests to App Router applications that define at least one Server Action can drive excessive CPU use in the Next.js process. That CPU use blocks further requests in the same process, causing a denial of service. Applications on the Pages Router, or that do not use Server Actions, are not affected. The fix limits how large nested arrays, strings, typed arrays, and integers can grow while a Server Action reply is decoded.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application uses the App Router with at least one Server Action.
Background info
next is vulnerable to Denial of Service in versions 13.0.0 - 15.5.27 and 16.0.0 - 16.4.0.
How to fix this
Upgrade the next library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.