AIKIDO-2026-284523
next is vulnerable to Denial of Service (DoS)
82
High Risk
This Affects:
nextTL;DR
Next.js applications using the App Router with at least one Server Action process crafted Server Action requests in a way that triggers excessive iteration during request handling. A single crafted request drives sustained CPU usage that blocks the event loop and prevents the process from handling further requests. An unauthenticated caller can therefore deny service to the whole process. The fix bounds the work performed while parsing Server Action requests.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application uses the App Router with at least one Server Action.
Background info
next is vulnerable to Denial of Service (DoS) in versions 13.0.0 - 15.5.20 and 16.0.0 - 16.2.10.
How to fix this
Upgrade the next library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant