CVE-2026-64641

Executive Summary

CVE-2026-64641 is a High-severity Denial of Service (DoS) vulnerability in Next.js, the popular React framework for building full-stack web applications. Versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10 are affected when using App Router with at least one Server Action. By sending crafted requests, an unauthenticated remote attacker can cause excessive CPU consumption, blocking all subsequent request processing on the same server process.

The vulnerability resides in the Server Actions mechanism, where malicious payloads can trigger unbounded computation or infinite loops, effectively creating a resource exhaustion attack. No public exploit code or PoC is available at this time. Patches have been released in versions 15.5.21 and 16.2.11.

Supply Chain & Package Security

As Next.js is distributed via npm (JavaScript package manager), this vulnerability directly impacts the software supply chain. Developers must immediately update their dependencies to patched versions. CI/CD pipelines should scan for affected ranges (next@<15.5.21 or next@^16.0.0 <16.2.11) and block builds using vulnerable versions. Verify your package-lock.json or yarn.lock to ensure no transitive dependencies pull in an unpatched Next.js.

CVSS Breakdown & Threat Level

• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – attacker needs no local access.
• Attack Complexity: Low (AC:L) – no special conditions.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no victim action needed.
• Scope: Unchanged (S:U) – impact stays within the web server.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – complete denial of service.

Threat Level: High – easy to exploit, no authentication, and direct impact on service availability.

Deep Dive & Mechanics

Next.js Server Actions (introduced in version 13) allow client components to invoke server-side functions via HTTP POST requests. The vulnerability arises from insufficient validation of request parameters that are processed by Server Actions. Specifically, a crafted request can cause the server to enter an infinite loop or perform extremely heavy CPU operations (e.g., recursion without base case, regex backtracking, or large object serialization). This blocks the Node.js event loop, preventing the process from handling any further requests until the malicious request finishes or the process is killed.

The issue is localized to the App Router (app/ directory) when at least one Server Action is defined. Even if the application uses only a single action, the vulnerable code path is reachable by anyone who can send HTTP requests to the server. No special headers or authentication tokens are required.

Root Cause: A missing or insufficient rate limiter/guard in the internal request parsing logic for Server Actions, combined with a mechanism that can generate unbounded work from attacker-controlled input.

Vulnerable vs. Patched Code

While the exact patch diff is not publicly available, the fix likely involves adding validation of input size/complexity and enforcing recursion depth limits in the Server Actions handler.

Vulnerable code snippet (conceptual):

// In server/action-handler.js (simplified)
export async function handleAction(actionId, args) {
  // No input nesting check
  const result = await executeAction(actionId, args); // args could be deeply nested
  return result;
}

Patched code snippet (conceptual):

export async function handleAction(actionId, args) {
  if (getDepth(args) > MAX_DEPTH) throw new Error('Too complex');
  const result = await executeAction(actionId, args);
  return result;
}

Exploitation & Lab Setup

Since no public exploit code exists, this section provides a conceptual proof of concept and detection guidance for blue teams.

Red Team (Simulating the Attack)

1. Setup: Deploy a Next.js application (vulnerable 15.5.20) with at least one Server Action (e.g., app/action.ts).
2. Craft the payload: The malicious request must trigger CPU exhaustion. For example, send a deeply nested JSON object or an array of strings that cause regex catastrophic backtracking inside the Server Action implementation.

   curl -X POST https://target.com/api/action \
     -H "Content-Type: application/json" \
     -d '{"nested": {"a": {"b": {"c": ... }}}}'  # repeat nesting
   

3. Observe: The server process spikes to 100% CPU and stops responding to other requests. Monitoring tools show high CPU usage for the Node.js process.
4. Cleanup: After testing, ensure the process is restarted to recover.

Note: Real exploit may require specific knowledge of the application's Server Action implementation. This is a generic approach.

Blue Team (Defense & Detection)

1. Monitor CPU Usage: Alert when a single Node.js process exceeds 80% CPU for more than 10 seconds.
2. Rate Limiting: Deploy a WAF or reverse proxy (e.g., Nginx) that limits POST requests to /api/action per IP.
3. Request Validation: Reject requests with excessive nested JSON depth or oversized payloads (>1MB).
4. Process Isolation: Run Next.js in a container with CPU limits (--cpus=1) to prevent total host DoS.

Indicators of Compromise (IOCs)

• CPU spikes: Sustained >90% CPU on the Node.js process for more than 30 seconds.
• Request patterns: POST requests to paths containing /action or similar, with unusually large JSON payloads (depth >20 or size >500KB).
• Log entries: Repeated Request timed out errors from Node.js, or ECONNRESET from reverse proxy.
• Network flow: Single source IP sending a flurry of POST requests to the same endpoint, each followed by a long processing delay.

Detection Engineering

YARA Rule (for log files or request captures)

rule detect_cve_2026_64641_attempt {
  meta:
    description = "Detect crafted requests targeting Next.js Server Actions DoS"
    author = "Valters IT"
    reference = "CVE-2026-64641"
  strings:
    $json_depth = /[{]\\s*(?:"[^"]*"\\s*:\\s*[{]){20,}/  // 20+ nested objects
    $array_depth = /[[]\\s*[[]\\s*[[]\\s*[[]\\s*[[]\\s*/   // 5+ nested arrays
    $long_string = /"[^"]{10000,}"/                        // very long string value
    $action_path = /\\/api\\/action/                       // typical action endpoint
  condition:
    (any of ($json_depth, $array_depth, $long_string)) and $action_path
}

Sigma Rule (for SIEM detection)

title: Next.js Server Actions DoS Attempt
id: s_cve_2026_64641
status: experimental
description: Detects HTTP POST requests with deeply nested JSON payloads to Next.js Server Action endpoints
references:
  - CVE-2026-64641
author: Valters IT
date: 2026/07/01
logsource:
  category: webserver
  product: nginx
detection:
  selection:
    method: POST
    uri|contains: /action
  condition: selection and (size > 1000000 or json_depth > 20)
  timeframe: 60s
falsepositives:
  - Legitimate complex operations (rare)
level: high

Suricata Rule (for network IDS)

alert http any any -> $HOME_NET any (msg:"CVE-2026-64641 Next.js Server Actions DoS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/action"; http_uri; pcre:"/\x7b\x3a\x7b\x3a\x7b\x3a\x7b\x3a\x7b/"; depth:5000; reference:cve,2026-64641; classtype:attempted-dos; sid:1000001; rev:1;)

Note: The PCRE pattern matches 5 or more nested { characters (escape sequences) to detect deep JSON.

Remediation & Mitigation

Immediate Patch:

• Upgrade Next.js to version 15.5.21 (for v15 users) or 16.2.11 (for v16 users).
• If immediate upgrade is not possible, apply the following mitigation:

Mitigation Steps:

1. Disable Server Actions if not required: set serverActions : false in next.config.js.
2. Use a reverse proxy (e.g., Nginx, HAProxy) to limit POST request rate to action endpoints.
3. Set maxBodySize to a low value (e.g., 1MB) in the reverse proxy.
4. Monitor CPU usage and restart processes aggressively.
5. Consider moving Server Actions to a separate microservice with resource limits.

Long-term Prevention:

• Implement input validation for all Server Actions, including depth and size checks.
• Use request timeout middleware (e.g., timeout package in Express).
• Perform code audits of custom Server Actions for potential infinite loops or regex DoS.

Valters IT Signatures
Cyber Threat Intelligence Division
Report generated: 2026-07-01
Confidence: High