UNKNOWN npm
Next.js: Unbounded Server Action payload in Edge runtime
GHSA-4c39-4ccg-62r3 · CVE-2026-64646
Published · Modified
Description
Impact
Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime
Workarounds
If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.
References
- WEB https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3
- WEB https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4
- WEB https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17
- PACKAGE https://github.com/vercel/next.js
- WEB https://github.com/vercel/next.js/releases/tag/v15.5.21
- WEB https://github.com/vercel/next.js/releases/tag/v16.2.11
Ready to move
Start Securing
Free, no credit card | First findings in minutes