Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| next | npm | >= 13.0.0, < 15.5.21 | 15.5.21 |
| next | npm | >= 16.0.0, < 16.2.11 | 16.2.11 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the areAllActionIdsValid function within packages/next/src/server/app-render/action-handler.ts. The function processes form data for server actions and is susceptible to a denial-of-service attack. The provided patch introduces a counter, seenActionRefs, to limit the number of $ACTION_REF_ fields processed from the incoming form data. Before this fix, an attacker could send a specially crafted form with an excessive number of these fields. The server would then enter a loop, iterating over all of them, which would consume a significant amount of CPU resources and render the server unresponsive to legitimate requests. The vulnerable function, areAllActionIdsValid, is the entry point for this processing and would appear in any runtime profile or stack trace when the vulnerability is triggered.
areAllActionIdsValidpackages/next/src/server/app-render/action-handler.ts