Bug 2507613 (CVE-2026-64641)
| Summary: | CVE-2026-64641 next: Next.js: Denial of Service via crafted requests to App Router with Server Actions | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aazores, abrianik, akostadi, amasferr, amctagga, ant, anujha, aoconnor, aschwart, asoldano, aszczucz, ataylor, avibelli, bbaranow, bbrownin, bgeorges, bmaxwell, bniver, boliveir, bstansbe, cescoffi, chfoley, cmah, dandread, dbruscin, dkreling, dlofthou, dmayorov, drichtar, eaguilar, ebaron, eborisov, ehugonne, ewittman, flucifre, fmariani, fmongiar, ggrzybek, gmalinko, gmeno, gotiwari, groman, gsmet, istudens, ivassile, iweiss, janstey, jhorak, jlledo, jmartisk, jmatsuok, jnethert, jraez, jtolenti, jwon, kaycoth, kvanderr, lball, lthon, manderse, mbenjamin, mcarlett, mhackett, mosmerov, mposolda, msvehla, mvyas, ngough, nipatil, nwallace, olubyans, pantinor, parichar, pberan, pesilva, pgallagh, pjindal, pmackay, probinso, rgodfrey, rguimara, rhel-process-autobot, rkubis, rmartinc, rruss, rstancel, rstepani, rsvoboda, sbiarozk, sostapov, ssilvert, sthorger, swoodman, tasato, tcunning, thjenkin, tqvarnst, tsedmik, vdosoudi, vereddy, veshanka, vmuzikar, watson-tool-maintainers, yfang |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usage, causing the application to become unresponsive and preventing it from processing further requests, resulting in a Denial of Service (DoS).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-07-27 19:02:18 UTC
|