Vulnerability record · CVE-2026-64641 · published 27 July 2026

CVE-2026-64641: Vercel next.js vulnerability

Vercel · Next.Js

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.

8.2 CVSS 4.0 High EPSS 0.86% · top 43.3% CWE-834 · CWE-834

8.2CVSS 4.0 base score

0.86%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

5References

29 Jul 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Next.Js Vercel

References

Link	Tags
https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12	Patch
https://github.com/vercel/next.js/pull/96013	Issue TrackingPatch
https://github.com/vercel/next.js/releases/tag/v15.5.21	ProductRelease Notes
https://github.com/vercel/next.js/releases/tag/v16.2.11	ProductRelease Notes
https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj	Vendor Advisory

Track CVE-2026-64641 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2025-55182React Server Components pre-auth deserialization RCEReact Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) u…KEVEPSS 100%analysed3 Dec 2025 9.1CVE-2025-29927Next.js middleware authorization bypass via x-middleware-subrequest headerNext.js versions from 1.11.4 up to (but not including) 12.3.5, 13.5.9, 14.2.25, and 15.2.3 allow authorization checks performed in middleware to be b…EPSS 99%analysed21 Mar 2025 8.6CVE-2026-44578Vercel next.js server-side request forgery (ssrf) vulnerabilityNext.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the …EPSS 1.9%13 May 2026 8.3CVE-2026-64649Vercel next.js server-side request forgery (ssrf) vulnerabilityNext.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server A…EPSS 0.46%27 Jul 2026 8.3CVE-2026-64642Vercel next.js improper authorization vulnerabilityNext.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applica…EPSS 0.64%27 Jul 2026 8.3CVE-2026-64645Vercel next.js open redirect vulnerabilityNext.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or…EPSS 0.41%27 Jul 2026 8.2CVE-2025-57822Vercel next.js server-side request forgery (ssrf) vulnerabilityNext.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly …EPSS 2.5%29 Aug 2025 8.1CVE-2026-44574Vercel next.js authentication bypass via alternate path vulnerabilityNext.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware…EPSS 0.67%13 May 2026

Source: NIST National Vulnerability Database (record CVE-2026-64641), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.