Tag
#Next.js
Next.js Denial of Service Vulnerability in App Router using Server Actions
A denial of service vulnerability exists in Next.js applications using App Router with at least one Server Action. Crafted requests can lead to excessive CPU usage, blocking further requests. Affected versions include Next.js 13.0.0 to 15.5.20 and 16.0.0 to 16.2.10.
Next.js Server-Side Request Forgery Vulnerability in Rewrites via Attacker-Controlled Destination Hostname
A critical vulnerability (CVE-2026-64645) has been discovered in Next.js, a popular React-based framework for building server-rendered, statically generated, and performance-optimized web applications. This vulnerability allows for Server-Side Request Forgery (SSRF) in rewrites via attacker-controlled destination hostnames, with a CVSS score of 8.3. The vulnerability affects Next.js versions >= 12.0.0 and < 15.5.21, as well as versions >= 16.0.0 and < 16.2.11. Immediate patching or workarounds are recommended to prevent potential SSRF attacks.