CVE-2026-64646

Next.js: Unbounded Server Action payload in Edge runtime

Published: Jul 22, 2026Modified: Jul 23, 2026

Severity

MODERATE

CVSS Scores

0.0/ 10.0

CVSS_V4

Low

Vector String

CVSS:4.0/AV:N/AC:L/PR:N/UI:N

Details

Impact

Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime

Workarounds

If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.

Affected Packages

nextnpm

Version Ranges:

Version Range: 13.0.0 - 15.5.21

nextnpm

Version Ranges:

Version Range: 16.0.0 - 16.2.11

References

https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3WEB https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4WEB

Aliases

CVE-2026-64646

CVE-2026-64646 - Next.js: Unbounded Server Action payload in Edge runtime | OSV Watch