UNKNOWN npm
Next.js: Unbounded Server Action payload in Edge runtime
GHSA-4c39-4ccg-62r3 · CVE-2026-64646
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime
Workarounds
If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.
References
- WEB https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3
- WEB https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4
- WEB https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17
- PACKAGE https://github.com/vercel/next.js
- WEB https://github.com/vercel/next.js/releases/tag/v15.5.21
- WEB https://github.com/vercel/next.js/releases/tag/v16.2.11
Ready to move
Start Securing
Free, no credit card | First findings in minutes