This vulnerability allows an attacker to send specially crafted HTTP requests to a Next.js application that uses the App Router with at least one Server Action. When processed, these requests trigger excessive CPU usage, which can block further request processing in the same server process, resulting in a denial of service. The weakness is characterized by CWE‑770, indicating a resource exhaustion flaw that compromises application availability.

All releases of vercel:next.js from version 13.0.0 up to, but not including, the patched releases 15.5.28 and 16.4.1. This includes all 13.x, 14.x, 15.x up to 15.5.27, and 16.x through 16.4.0. Applications built with the Pages Router or that do not employ Server Actions are not affected.

The CVSS score of 8.2 reflects a high severity, indicating that exploitation has a significant impact on availability. The EPSS score is not available; however, the lack of KEV status does not negate the potential for real-world attacks. Based on the description, the likely attack vector is remote over the network, with an attacker sending HTTP requests that target the App Router’s Server Actions endpoint. An attacker would need no privileged access and could potentially flood the server with such requests to exhaust CPU resources and deny legitimate traffic.