PT-2026-63561 · Npm · Next

CVE-2026-64646 · Publicado 2026-07-22 · Atualizado 2026-07-22

OSV

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Impact

Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime

Workarounds

If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2026-64646

GHSA-4C39-4CCG-62R3

Produtos afetados

Next

Referências · 7

• https://github.com/vercel/next.js/releases/tag/v16.2.11 · Nota
• https://github.com/vercel/next.js · Nota
• https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3 · Nota
• https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4 · Nota
• https://github.com/vercel/next.js/releases/tag/v15.5.21 · Nota
• https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17 · Nota
• https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3 · Aviso do Fabricante