# CVE-2026-64641: Next.js: Denial of Service in App Router using Server Actions

- Exploited (CISA KEV): no
- Published: 2026-07-27
- CVSS: 8.2 HIGH (v4.0)
- EPSS: 0.9% (58th percentile)
- CWE: CWE-834

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2026-07-21 | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2026-10-21 | 86 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2026-07-21 · updated · rule b013b67c357547b4b866234390dcdb0a · default Block
  > Next.js - DoS - CVE-2026-64641. Previous action: N/A. New action: Block. This was labeled as Generic Rules - DoS.
  Source: https://developers.cloudflare.com/changelog/post/2026-07-21-waf-release/

### F5

- 2026-10-21 · new · rule 200012105
  > Added: signature 200012105 "Next.js Denial of Service (3)" (Denial of Service, risk Medium), systems: Node.js, ReactJS. References: CVE-2026-64641.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-64641 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-64641