Detections
Analytics
Next.js Framework 13.x / 14.x / 15.x < 15.5.28 / 16.x < 16.4.1 Server Actions DoS (GHSA-p3m5-59mp-jv5r)
high Nessus Plugin ID 373651
Synopsis
The Next.js Framework on the remote host is affected by a denial of service vulnerability.Description
The Next.js Framework on the remote host is affected by a denial of service vulnerability:- A denial of service vulnerability exists in Next.js applications using the App Router with at least one Server Action. Crafted requests targeting such an application can cause excessive CPU consumption, which blocks the processing of further requests in the same process. Applications using the Pages Router, and App Router applications that do not use Server Actions, are not affected. (CVE-2026-94482)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Next.js Framework version 15.5.28 / 16.4.1 or later.See Also
https://github.com/vercel/next.js/releases/tag/v15.5.28
Plugin Details
Severity: High
ID: 373651
File Name: nextjs_framework_CVE-2026-94482.nasl
Version: 1.2
Type: Local
Agent: windows, macosx, unix
Family: Misc.
Published: 10/29/2026
Updated: 10/30/2026
Configuration: Enable thorough checks (optional)
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.73
CVSS v2
Risk Factor: High
Base Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2026-94482
CVSS v3
Risk Factor: High
Base Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4
Risk Factor: High
Base Score: 8.2
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
CPE: cpe:/a:vercel:next.js
Required KB Items: Host/nodejs/modules/enumerated
Patch Publication Date: 10/14/2026
Vulnerability Publication Date: 10/22/2026
Reference Information
CVE: CVE-2026-94482
CWE: 770
IAVA: 2026-A-1205