PT-2026-63561 · Npm · Next

CVE-2026-64646 · Published 2026-07-22 · Updated 2026-07-22

OSV

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Impact

Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime

Workarounds

If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-64646

GHSA-4C39-4CCG-62R3

Affected Products

Next

References · 7

• https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3 · Vendor Advisory
• https://github.com/vercel/next.js/releases/tag/v16.2.11 · Note
• https://github.com/vercel/next.js · Note
• https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3 · Note
• https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4 · Note
• https://github.com/vercel/next.js/releases/tag/v15.5.21 · Note
• https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17 · Note