CVE-2026-64646

Name of the Vulnerable Software and Affected Versions Next.js versions 13.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10

Description Requests targeting applications using App Router with at least one Server Action can lead to excessive memory consumption when that Server Action utilizes the Edge runtime, which is a lightweight environment designed to run code closer to the user.

Recommendations Update Next.js versions 13.0.0 through 15.5.20 to version 15.5.21. Update Next.js versions 16.0.0 through 16.2.10 to version 16.2.11. Ensure the hosting provider limits the request body size to a maximum of 5 MiB.