CVE-2026-64646: Next.js: Unbounded Server Action payload in Edge runtime
Impact
Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime
Workarounds
If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.
Other sources
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.2.11 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.5.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.2.11 - Configuration
If you cannot upgrade, ensure your hosting provider limits the request's body size to 5 MiB at maximum.
Hosting provider / Next.js application (request body size) Maximum request body size = 5 MiB (max)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64646?
The severity of CVE-2026-64646 is rated at 29.
How do I fix CVE-2026-64646?
To fix CVE-2026-64646, upgrade your Next.js application to the latest version.
What is the impact of CVE-2026-64646 on Next.js applications?
CVE-2026-64646 can lead to excessive memory consumption in Next.js applications using the Edge runtime with Server Actions.
What can I do if I cannot upgrade to fix CVE-2026-64646?
If you cannot upgrade, ensure your hosting provider limits the request's body size to mitigate CVE-2026-64646.
Which version of Next.js is affected by CVE-2026-64646?
CVE-2026-64646 affects Next.js applications utilizing the App Router with at least one Server Action.