psf-nextjs-server-actions-check(8)
Next.js Server Actions denial of service: read-only checker (v1)
CVE-2026-94482
If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation
Crafted requests aimed at a Next.js App Router application that has at least
one Server Action can cause excessive CPU consumption and block the processing
of further requests in the same Node.js process. CVSS 8.2 (v4.0), 7.5 (v3).
No authentication is needed.
Affected: next 13.0.0 up to 15.5.28, and 16.0.0 up to 16.4.1
Fixed: 15.5.28 and 16.4.1
Not affected: Pages Router applications, and App Router applications that
have no Server Action.
Next.js 13.x and 14.x apps move to 15.5.28 or later.
This script is read-only. It reads the Next.js version from package-lock.json,
npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml and from installed
node_modules/next copies, then checks the project for the App Router and for
Server Actions ("use server" directives, or a populated
.next/server/server-reference-manifest.json for built-only deployments).
Usage:
./nextjs-server-actions-check.sh [command] [DIR ...]
check (default) scan DIR (default /var/www /srv /opt /home).
Exit 0 = nothing exposed, 1 = an affected project with
Server Actions was found.
version print the script version.
Containers: with no directory argument the check also reads the project files it needs from
running docker and podman containers (SCAN_CONTAINERS=1, the default; 0 skips them), through a
read-only probe, and judges them like host projects. The copies are temporary: a path shown as
.../docker_NAME/PATH is the PATH inside the container NAME.The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.
