A vulnerability in Next.js allows crafted requests to an application that uses the App Router with at least one Server Action to cause the Node.js process to consume excessive CPU time. The elevated CPU usage can block processing of additional incoming requests within that same process, effectively denying service to legitimate users. The weakness is classified as CWE-834, indicating a misuse of operating system resources.

The issue affects Next.js versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, used in web applications that incorporate the App Router and Server Action features. Versions 15.5.21 and 16.2.11 contain the fix.

The CVSS score of 8.2 reflects high severity. The EPSS score of <1% (≈0.00599) indicates a very low but nonzero exploitation probability, suggesting that exploitation is unlikely but not impossible. The likely attack vector is sending specially crafted HTTP requests to the target application, indicating remote attack potential. It is not listed in the CISA KEV catalog, and no public exploits have been documented at this time.