Vulnerability · Published Jul 27, 2026 · Assigned by GitHub_M

CVE-2026-64646Next.js: Unbounded Server Action payload in Edge runtime

Medium 6.3

In plain English

A medium-severity resource allocation without limits in next.js from vercel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.5%top 55.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	next	15.5.21	GHSA-4c39-4ccg-62r3
npm	next	16.2.11	GHSA-4c39-4ccg-62r3

Affected products (as reported)

Vendor	Product	Versions
vercel	next.js	>= 13.0.0 < 15.5.21>= 16.0.0, < 16.2.11

Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3 x_refsource_CONFIRM
https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4 x_refsource_MISC
https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17 x_refsource_MISC
https://github.com/vercel/next.js/releases/tag/v15.5.21 x_refsource_MISC
https://github.com/vercel/next.js/releases/tag/v16.2.11 x_refsource_MISC