EUVD-2026-49401
GHSA-4c39-4ccg-62r3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no authentication or user interaction needed; impact is availability-only via memory exhaustion; scope unchanged.
Primary rating from Vendor (https://github.com/vercel/next.js).
CVSS VectorVendor: https://github.com/vercel/next.js
Lifecycle Timeline
4Blast Radius
ecosystem impact- 16 npm packages depend on next (15 direct, 1 indirect)
Ecosystem-wide dependent count for version 13.0.0.
DescriptionCVE.org
Impact
Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime
Workarounds
If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.
AnalysisAI
Unbounded Server Action payload processing in Next.js App Router exhausts server memory when the affected Server Action uses the Edge runtime, enabling remote denial of service without authentication. Any Next.js application on npm/next versions 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 that exposes at least one Server Action on the Edge runtime is vulnerable. An attacker can send arbitrarily large HTTP request bodies to trigger runaway memory allocation, potentially crashing the process or degrading service for all users. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Technical ContextAI
Next.js App Router introduced Server Actions (functions marked 'use server') as a mechanism to execute server-side logic directly from React components. The affected code path is in packages/next/src/server/app-render/action-handler.ts, which handles incoming POST requests destined for Server Actions. When a Server Action is configured with the Edge runtime (export const runtime = 'edge'), the action handler called req.request.formData() directly - a convenience API that buffers the entire request body into memory before parsing. A TODO comment in the original code ('// TODO: add body limit') confirms that body size enforcement was intentionally deferred and never implemented for the Edge runtime path. By contrast, the Node.js (non-Edge) runtime path already enforced the configurable bodySizeLimit (defaulting to 1 MB). CWE-770 (Allocation of Resources Without Limits or Throttling) precisely describes this class of flaw. Affected packages are identified as pkg:npm/next versions >= 13.0.0 and < 15.5.21, and >= 16.0.0 and < 16.2.11.
RemediationAI
The primary fix is to upgrade Next.js to version 15.5.21 (for the 13.x-15.x line) or 16.2.11 (for the 16.x line), available at https://github.com/vercel/next.js/releases/tag/v15.5.21 and https://github.com/vercel/next.js/releases/tag/v16.2.11 respectively. The patch (commits 57c31f724d and 9a4651e754) adds streaming chunk-by-chunk body reading with a 1 MB default limit for Edge-runtime Server Actions, throwing HTTP 413 when exceeded. If upgrading immediately is not possible, the vendor-recommended workaround is to configure the hosting provider or reverse proxy to enforce a maximum request body size of 5 MiB or less - this prevents unbounded memory allocation before the request reaches Next.js. Note that this workaround requires infrastructure-level control and does not apply if the hosting environment does not support body-size limits. After patching, the Next.js bodySizeLimit setting under serverActions in next.config.js can be used to tune the limit; the default of 1 MB is enforced automatically post-patch. No trade-offs to patching have been identified.
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today