Which versions of Red Hat are affected by CVE-2026-64641?

Next.js applications with App Router and Server Actions are exposed to denial-of-service vulnerability that renders production instances completely unavailable by exhausting CPU resources through…. A patch is available.

How to fix or mitigate CVE-2026-64641?

Within 24 hours, identify and inventory all production and staging Next.js deployments running App Router with Server Actions to determine exposure scope. Within 7 days, apply patch available per vendor advisory-locate the patched Next.js version addressing CVE-2026-64641, test in staging environments, and deploy to production with validation that form submission processing functions normally. Within 30 days, complete deployment to all affected systems, document patch status, and monitor application performance to confirm the resource exhaustion vulnerability is resolved.

Red Hat CVE-2026-64641

Q: What is the CVSS score of CVE-2026-64641?

CVE-2026-64641 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-49381 HIGH

Excessive Iteration (CWE-834)

2026-07-22 https://github.com/vercel/next.js

GHSA-m99w-x7hq-7vfj

Information Disclosure Red Hat

8.2

CVSS 4.0 · Vendor: https://github.com/vercel/next.js

Severity by source

Vendor (https://github.com/vercel/next.js) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote unauthenticated crafted request with no interaction (AV:N/AC:L/PR:N/UI:N) causes CPU exhaustion affecting only availability, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (https://github.com/vercel/next.js).

CVSS VectorVendor: https://github.com/vercel/next.js

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 27, 2026 - 18:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 27, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Jul 27, 2026 - 18:22 NVD

8.2 (HIGH)

Source Code Evidence Fetched

Jul 22, 2026 - 23:16 vuln.today

Analysis Generated

Jul 22, 2026 - 23:16 vuln.today

CVE Published

Jul 22, 2026 - 22:59 cve.org

HIGH

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

16 npm packages depend on next (15 direct, 1 indirect)

Ecosystem-wide dependent count for version 13.0.0.

DescriptionCVE.org

Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

AnalysisAI

Denial of service in Next.js App Router with Server Actions allows remote attackers to exhaust CPU resources and block request processing. Affected versions include all 13.0.0–15.5.20 and 16.0.0–16.2.10 releases. No active exploitation or public exploit code has been identified at time of analysis.