Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-27T18:54:59 next: Next.js: Denial of Service via excessive memory consumption in Server Actions 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.

A flaw was found in Next.js. An attacker sending specially crafted requests to a Next.js application utilizing the App Router with Server Actions configured to use the Edge runtime can cause excessive memory consumption. This can lead to a denial of service (DoS) due to resource exhaustion.

An Important denial of service flaw exists in Next.js applications utilizing the App Router with Server Actions configured to use the Edge runtime. This vulnerability can lead to excessive memory consumption, potentially causing service unavailability. Red Hat products that embed or deploy Next.js applications with this specific configuration are affected. Red Hat Enterprise Linux 10 Affected firefox Red Hat Enterprise Linux 10 Affected thunderbird Red Hat Enterprise Linux 7 Affected firefox Red Hat Enterprise Linux 8 Affected firefox Red Hat Enterprise Linux 8 Affected thunderbird Red Hat Enterprise Linux 9 Affected firefox Red Hat Enterprise Linux 9 Affected thunderbird Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat Trusted Artifact Signer Not affected rhtas/rekor-search-ui-rhel9 streams for Apache Kafka 2 Affected next streams for Apache Kafka 3 Affected next https://www.cve.org/CVERecord?id=CVE-2026-64646 https://nvd.nist.gov/vuln/detail/CVE-2026-64646 https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4 https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17 https://github.com/vercel/next.js/releases/tag/v15.5.21 https://github.com/vercel/next.js/releases/tag/v16.2.11 https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3