~ / search / GHSA-4c39-4ccg-62r3

GHSA-4c39-4ccg-62r3

Next.js: Unbounded Server Action payload in Edge runtime

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-64646

Packages

EcosystemPackageAffectedFixed in
npm next >= 13.0.0, < 15.5.21 15.5.21
npm next >= 16.0.0, < 16.2.11 16.2.11

Details

As written in the advisory (Markdown source, shown as plain text).

## Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime ## Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.

References

External links from the advisory. They lead to third-party sites.