Crafted requests to a Next.js Server Action can stall the process
On October 14, 2026, Next.js published GHSA-p3m5-59mp-jv5r. Crafted requests to an App Router app that has at least one Server Action can burn CPU until that process stops handling further requests. Patched releases are next 15.5.28 and 16.4.1.