Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.
References
| Link | Resource |
|---|---|
| https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4 | Patch |
| https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17 | Patch |
| https://github.com/vercel/next.js/releases/tag/v15.5.21 | Product Release Notes |
| https://github.com/vercel/next.js/releases/tag/v16.2.11 | Product Release Notes |
| https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
29 Jul 2026, 14:39
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4 - Patch | |
| References | () https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17 - Patch | |
| References | () https://github.com/vercel/next.js/releases/tag/v15.5.21 - Product, Release Notes | |
| References | () https://github.com/vercel/next.js/releases/tag/v16.2.11 - Product, Release Notes | |
| References | () https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CPE | cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* | |
| First Time |
Vercel
Vercel next.js |
27 Jul 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-27 19:17
Updated : 2026-07-29 14:39
NVD link : CVE-2026-64646
Mitre link : CVE-2026-64646
CVE.ORG link : CVE-2026-64646
JSON object : View
Products Affected
vercel
- next.js
CWE
CWE-770
Allocation of Resources Without Limits or Throttling