CVE-2026-64646 in Next.js
Summary
by MITRE • 07/27/2026
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability affects Next.js applications utilizing the App Router with Server Actions that employ the Edge runtime, creating a condition where memory consumption can become excessive under specific request patterns. The flaw manifests when requests are made to applications configured with Server Actions running in the Edge environment, leading to resource exhaustion that impacts application performance and stability. The vulnerability exists across multiple version ranges including 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, indicating a widespread issue affecting the framework's edge runtime implementation.
The technical root cause involves improper memory management within the Edge runtime execution environment when processing Server Action requests. When these server-side functions execute in the Edge runtime context, they can accumulate memory references or fail to properly release resources between request cycles, resulting in memory leaks that compound over time. This behavior aligns with common patterns seen in edge computing environments where resource constraints and execution model differences can create unexpected memory consumption patterns. The vulnerability specifically impacts the interaction between the App Router's routing mechanism and Server Actions configured for Edge runtime execution.
The operational impact of this vulnerability extends beyond simple performance degradation to potentially causing application instability or complete service unavailability. Excessive memory consumption can lead to increased garbage collection overhead, reduced application responsiveness, and in severe cases may cause the Node.js process to crash or become unresponsive. This issue particularly affects applications that receive high volumes of requests targeting Server Actions, as the memory accumulation occurs with each request processing cycle. Organizations relying on Next.js applications for critical web services face potential downtime risks and degraded user experience when this vulnerability is present in their deployments.
Mitigation strategies should prioritize upgrading to patched versions 15.5.21 and 16.2.11 where the memory handling issues have been resolved. System administrators should also implement monitoring solutions to detect unusual memory consumption patterns that may indicate this vulnerability's presence. Additional defensive measures include limiting concurrent Server Action requests, implementing proper resource cleanup in custom Edge runtime code, and conducting regular performance testing of applications under load conditions. Organizations should also consider implementing request throttling mechanisms and memory usage alerts as part of their operational security practices. This vulnerability demonstrates the importance of proper resource management in edge computing environments and aligns with common security concerns identified in CWE categories related to resource management and memory handling. The issue also relates to ATT&CK techniques involving resource exhaustion and application stability compromise, emphasizing the need for comprehensive security testing across all runtime environments including edge computing contexts.