---
id: CVE-2026-64646
aliases:
  - GHSA-4c39-4ccg-62r3
title: 'Next.js: Unbounded Server Action payload in Edge runtime'
summary: 'Next.js: Unbounded Server Action payload in Edge runtime'
severity: medium
cwe:
  - CWE-770
vendor: next
product: next
ecosystem: npm
affected:
  - 'next >= 13.0.0, < 15.5.21'
  - 'next >= 16.0.0, < 16.2.11'
patched:
  - next 15.5.21
  - next 16.2.11
published: '2026-07-22'
updated: '2026-07-22'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-4c39-4ccg-62r3'
references:
  - url: 'https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3'
  - url: >-
      https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4
  - url: >-
      https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17
  - url: 'https://github.com/vercel/next.js/releases/tag/v15.5.21'
  - url: 'https://github.com/vercel/next.js/releases/tag/v16.2.11'
  - url: 'https://github.com/advisories/GHSA-4c39-4ccg-62r3'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-22T23:07:32.194Z'
epss: 0.00531
epssPercentile: 0.43827
---

## Overview

## Impact

Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime

## Workarounds

If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.

## Affected packages

- `next >= 13.0.0, < 15.5.21`
- `next >= 16.0.0, < 16.2.11`

## Remediation

Upgrade to a patched release:

- `next 15.5.21`
- `next 16.2.11`