VulnSocial

CVE-2026-64641Patch(vercel / next.js)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch vercel next.js systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.

vercel CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-834

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • next.js

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-24); latest day: 1
  • 4 total mentions across 3 days

Affected systems

Vendors
vercel
Products
next.js

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-07-23: 1Mentions · 2026-07-24: 2Mentions · 2026-07-27: 1Patch / Workaround · 2026-07-23: 1Patch / Workaround · 2026-07-24: 2Technical Details · 2026-07-23: 1Technical Details · 2026-07-24: 207-2307-2407-27
Signal classification2 categories
Patch
375.0%
General
125.0%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-07-231
Patch1
2026-07-242
Patch2
2026-07-271
General1
Full discourse4 posts
  • Repojournal@repojournal
    Patch

    Workflow patches CVE-2026-64641 (Next.js 16.2.11) and CVE-2026-45623 (PostCSS >=8.5.12) overnight. Both flagged critical. Workflow also tightened HTTP delivery shutdown and added stream overhead benchmarks to catch regressions earlier. Next.js got client-trace attribution in the render pipeline. Benchmarks now document what they measure. Vercel CLI: team scope now persists across re-login (fixes the `vc switch` stale-team wedge). New opt-in native binary trampoline. First deploy to production now gets a heads-up notice. Eve locked down workflow failure visibility. Private by default now. Full diff + who shipped it below. #nextjs

    Post summary

    The text announces overnight patches for two critical CVEs in Next.js and PostCSS, highlighting the updates without providing exploitation details.

    12030199
    364 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-64641 Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.… https://www.cve.org/CVERecord?id=CVE-2026-64641

    Post summary

    The snippet provides only a brief CVE reference and version information without any evidence of PoC, exploit code, active exploitation, or mitigation.

    00010692
    57.9K followersView on X
  • Luis Torres@4Ndr3w10000
    Patch

    Next.js shipped its July security release: 4 high, 5 medium. One (CVE-2026-64641) lets a crafted request to any App Router app with a Server Action spike CPU and DoS you. Patched in 16.2.11 and 15.5.21. Older minors won't get the fix, so bump the minor, don't wait.

    Post summary

    The announcement informs users of a DoS vulnerability (CVE-2026-64641) in Next.js, provides patch versions, and urges upgrading to mitigate the risk.

    0000043
    42 followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨High - Next.js Denial of Service via App Router Server Actions (CVE-2026-64641) Next.js applications using the App Router with at least one Server Action can be hit with crafted requests that cause excessive CPU usage, blocking the process from handling any further requests - an unauthenticated, low-complexity denial of service. The impact is availability only (no data exposure or code execution), but because App Router with Server Actions is the default modern Next.js pattern, the exposed surface is broad. Pages Router apps and apps without Server Actions are not affected. CVSS 8.2. 👉Upgrade Next.js to 15.5.21 or 16.2.11. No workaround exists besides upgrading.

    Post summary

    This advisory highlights CVE‑2026‑64641, a high‑severity denial-of-service vulnerability affecting Next.js App Router Server Actions. It provides technical details and directs users to patch by upgrading to Next.js 15.5.21 or 16.2.11.

    0000080
    254 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appvercelnext.js-node.js-

Explore more

Back to dashboardvercel CVEsnext.js vulnerabilities