{"action":"Upgrade next to 15.5.21 or later.","affected":[{"fixed":"15.5.21","introduced":"13.0.0"},{"fixed":"16.2.11","introduced":"16.0.0"}],"component":"next","cve_ids":["CVE-2026-64641"],"ecosystem":"npm","epss":0.00856,"exploited":false,"fixed_versions":["15.5.21","16.2.11"],"ghsa_id":"GHSA-m99w-x7hq-7vfj","id":"tcs_01M5KG0BYQF310GZDMC30Y4VAD","modified_at":"2026-09-10T03:50:52.718971454Z","published_at":"2026-07-22T22:59:01Z","references":["https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj","https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj","https://github.com/vercel/next.js/pull/96013","https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12","https://github.com/vercel/next.js","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-m99w-x7hq-7vfj","url":"https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj"}],"summary":"Next.js: Denial of Service in App Router using Server Actions"}