TIDES-2026-006highCVSS 8.2

Next.js Server Action requests could cause denial of service

Until July 23, 2026, Tides used a Next.js version affected by CVE-2026-64641, in which crafted requests to an App Router application using Server Actions could cause excessive CPU use and temporarily reduce availability.

Published Aug 7, 2026 · Last updated Aug 7, 2026

Affected surfaces

Next.js App Router Server Actions

Affected period

June 15 through July 23, 2026

Impact

A remote unauthenticated attacker could have sent crafted requests that consumed excessive CPU in an affected serving process, temporarily degrading availability. The issue did not itself expose or modify customer data. Tides found no evidence of exploitation.

Remediation

On July 23, 2026, Tides deployed Next.js 16.2.11, the upstream release containing the fix, and verified the patched version in the production Vercel build and current lockfile.

Customer action

No action is required.

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Acknowledgments

Vercel and the Next.js security team, Tides Pilates internal security review

References

https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj