GitHub Advisoryadvisory · npm

GHSA-4c39-4ccg-62r3 Next.js: Unbounded Server Action payload in Edge runtime

MEDIUM Published 2026-07-22 Modified 2026-07-22 Official page ↗
Aliases
CVE-2026-64646
Ecosystem
npm
Packages
next
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-770
Reviewed
2026-07-22

Affected packages

• npm next: >= 13.0.0, < 15.5.21 → fixed in 15.5.21 • npm next: >= 16.0.0, < 16.2.11 → fixed in 16.2.11

Description

Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.

Related

Alias · CVE (1)

  • CVE-2026-64646 Next.js is a React framework for building full-stack web applications. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References