Feed/CVE-2026-64646
CVE-2026-64646MEDIUMCVSS 5.3

Next.js: Unbounded Server Action payload in Edge runtime

Published Jul 22, 2026·Updated Jul 29, 2026

NVD Description

## Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime ## Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.

Affected Packages (1)

nextNPM
From 13.0.0
Fixed in 15.5.21

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Register your stack and get notified within minutes when a matching CVE drops.

Start monitoring free