What is the CVSS score of CVE-2026-64641?

CVE-2026-64641 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.5%.

CVE-2026-64641

Q: How to fix or mitigate CVE-2026-64641?

Within 24 hours, identify and inventory all production and staging Next.js deployments running App Router with Server Actions to determine exposure scope. Within 7 days, apply patch available per vendor advisory-locate the patched Next.js version addressing CVE-2026-64641, test in staging environments, and deploy to production with validation that form submission processing functions normally. Within 30 days, complete deployment to all affected systems, document patch status, and monitor application performance to confirm the resource exhaustion vulnerability is resolved.

EUVD-2026-49381 HIGH

Excessive Iteration (CWE-834)

2026-07-22 https://github.com/vercel/next.js

GHSA-m99w-x7hq-7vfj

Information Disclosure

8.2

CVSS 4.0 · Vendor: https://github.com/vercel/next.js

View

Vulnerability Assessment

Weakness

CWE

CWE-834

ASVS 5.0

V15 - Secure Coding and Architecture Excessive iteration

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Jul 27, 2026

Denial of service in Next.js App Router with Server Actions allows remote attackers to exhaust CPU resources and block request processing. Affected versions include all 13.0.0–15.5.20 and 16.0.0–16.2.10 releases. No active exploitation or public exploit code has been identified at time of analysis.

Earlier versions of this analysis (1)

v1 Jul 22, 2026 - 23:16

Uncontrolled resource consumption in Next.js applications built on the App Router with at least one Server Action lets remote attackers send crafted form requests that force excessive iteration and CPU exhaustion, blocking all further request processing in the affected worker process (denial of service). The flaw stems from unbounded processing of repeated $ACTION_REF_ fields in submitted form data. No public exploit is identified at time of analysis, but the fixing pull request (vercel/next.js#96013) publicly reveals the exact triggering mechanism, and no configuration workaround exists other than upgrading.

Affected VersionsENISA

next.js 13.0.0, < 15.5.21

next.js 16.0.0, < 16.2.11

Affected Packages

npm next fix: 15.5.21, 16.2.11

euvd next_js_13_0_0 fix: 15.5.21

euvd next_js_16_0_0 fix: 16.2.11

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in npm, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/vercel/next.js) PRIMARY 8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

vuln.today AI 7.5 HIGH

Remote unauthenticated crafted request with no interaction (AV:N/AC:L/PR:N/UI:N) causes CPU exhaustion affecting only availability, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat 7.5 HIGH

Primary rating from Vendor (https://github.com/vercel/next.js).

CVSS VectorVendor: https://github.com/vercel/next.js

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Analysis Updated

Jul 27, 2026 - 18:29 vuln.today

v2 - CVSS changed

CVSS changed

Jul 27, 2026 - 18:22 NVD

8.2 (HIGH)

CVE Published

Jul 22, 2026 - 22:59 cve.org

HIGH

DescriptionCVE.org

Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

16 npm packages depend on next (15 direct, 1 indirect)

Ecosystem-wide dependent count for version 13.0.0.

Executive ViewAI

Why It Matters

Next.js applications with App Router and Server Actions are exposed to denial-of-service vulnerability that renders production instances completely unavailable by exhausting CPU resources through crafted form requests. This directly impacts service availability and user access across affected applications. No public exploit identified at time of analysis, but a vendor patch is available and requires immediate deployment.

Recommended Action

Within 24 hours, identify and inventory all production and staging Next.js deployments running App Router with Server Actions to determine exposure scope. Within 7 days, apply patch available per vendor advisory-locate the patched Next.js version addressing CVE-2026-64641, test in staging environments, and deploy to production with validation that form submission processing functions normally. Within 30 days, complete deployment to all affected systems, document patch status, and monitor application performance to confirm the resource exhaustion vulnerability is resolved.

Business Impact: High

Compensating Controls

Apply vendor patch. No configuration-based mitigations exist; patching is the only remediation path.

Threat Intelligence Overview

EPSS Score

0.5%

Top 58% exploitable

Threat Intel

1 source

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +41

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.