Packages / next / Security

ModerateVulnerabilityGHSA-4c39-4ccg-62r3CVE-2026-64646Published 22 Jul 2026

Next.js: Unbounded Server Action payload in Edge runtime

Affected releases · next

  • 16.x16.0.0 – 16.2.10Fixed in 16.2.11
  • 15.x15.0.0 – 15.5.20Fixed in 15.5.21
  • 14.x14.0.0 – 14.2.35No fix on this line yet
  • 13.x13.0.0 – 13.5.11No fix on this line yet

On 16.x, the newest line:

npm install next@16.2.11
16.x

  1. Affected

    16.0.0 – 16.2.10

    31 releases

  2. Fixed

    16.2.11 – 16.4.2

    14 releases, latest

15.x

  1. Affected

    15.0.0 – 15.5.20

    74 releases

  2. Fixed

    15.5.21 – 15.5.28

    8 releases

14.x

  1. Affected

    14.0.0 – 14.2.35

    46 releases

13.x

  1. Affected

    13.0.0 – 13.5.11

    56 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime

Workarounds

If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.