Crafted requests to a Next.js Server Action can stall the process

The Next.js advisory published October 14, 2026 says crafted requests aimed at an App Router application that has at least one Server Action can drive CPU use high enough to block further requests in the same process. The affected ranges are next 13.0.0 through 15.5.27, and next 16.0.0 through 16.4.0. The patched releases are 15.5.28 and 16.4.1. The advisory says there is no workaround besides upgrading. Applications using the Pages Router, or not using Server Actions, are not vulnerable.

The same day's Next.js post names a related React advisory, GHSA-h3gv-c5rc-p453. That advisory says specially crafted HTTP requests to server function endpoints can cause out-of-memory exceptions or excessive CPU use. It names react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. The advisory's version data lists those packages at 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0, with fixes in 19.0.9, 19.1.10, 19.2.9, and 19.3.1. The advisory text names a shorter affected range, 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7, and the same fixed versions. The text and the version data disagree. This note uses the version data for the affected range. The advisory also says an app whose React code does not use a server, or that does not use a framework or bundler supporting React Server Components, is not affected.