{"id":"GHSA-4c39-4ccg-62r3","revision":"010732e4c7384a6682d3a5fc5217311d","records":[{"revision":"010732e4c7384a6682d3a5fc5217311d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-4c39-4ccg-62r3","aliases":["CVE-2026-64646"],"title":"Next.js: Unbounded Server Action payload in Edge runtime","description":"## Impact\n\nRequests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime\n\n## Workarounds\n\nIf you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.","state":0,"publishedAt":"2026-07-22T23:02:43+00:00","modifiedAt":"2026-09-10T03:50:51.3987624+00:00","affected":[{"ecosystem":"npm","name":"next","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"13.0.0"},{"kind":"fixed","version":"15.5.21"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"next","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"16.0.0"},{"kind":"fixed","version":"16.2.11"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3","https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4","https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17","https://github.com/vercel/next.js","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11"],"sourceUrl":"https://github.com/advisories/GHSA-4c39-4ccg-62r3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-4c39-4ccg-62r3","identifiers":["GHSA-4c39-4ccg-62r3","CVE-2026-64646"]},"retained":false,"historicalAffected":[]}],"coverage":[]}