CVE-2026-64646
Received Received - Intake

Memory Exhaustion in Next.js App Router

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-28
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-64646
EUVD
EUVD-2026-49401

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
vercel next.js From 13.0.0 (inc) to 15.5.20 (inc)
vercel next.js From 16.0.0 (inc) to 16.2.10 (inc)
vercel next.js 15.5.21
vercel next.js 16.2.11
vercel next.js From 13.0.0 (inc) to 15.5.21 (exc)
vercel next.js From 16.0.0 (inc) to 16.2.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Next.js applications using App Router with Server Actions configured to use the Edge runtime. It allows requests to cause excessive memory consumption, potentially leading to denial of service.

Detection Guidance

Detecting this vulnerability requires checking the version of Next.js being used in your application. If you are using App Router with Server Actions and the Edge runtime, verify if the version falls within the affected range (13.0.0 through 15.5.20 or 16.0.0 through 16.2.10). Use commands like 'npm list next' or 'yarn list next' to check the installed version.

Impact Analysis

If exploited, this could cause your Next.js application to consume too much memory, slowing down or crashing the server. This may disrupt service availability for users.

Compliance Impact

This vulnerability primarily impacts system availability by enabling excessive memory consumption, which could lead to denial-of-service conditions. It does not directly affect confidentiality or integrity of data. Compliance with GDPR or HIPAA is not directly violated by this issue, but denial-of-service conditions could indirectly impact availability requirements under these regulations.

Mitigation Strategies

Upgrade Next.js to a patched version (15.5.21 or 16.2.11 or later) immediately. If upgrading is not possible, disable Server Actions using the Edge runtime in your Next.js application until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64646. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart