Memory Consumption Vulnerability in Next.js Framework from Vercel
CVE-2026-64646
6.3MEDIUM
What is CVE-2026-64646?
Next.js, a popular React framework, has a memory consumption issue affecting its App Router when Server Actions utilize the Edge runtime. This vulnerability can cause significant resource drain, impacting the performance of Next.js applications. It particularly affects versions 13.0.0 to 15.5.20 and 16.0.0 to 16.2.10. Users are advised to update to versions 15.5.21 or 16.2.11, where this issue has been resolved. Mitigating this vulnerability is crucial for maintaining optimal application performance and security.
Affected Version(s)
next.js >= 13.0.0 < 15.5.21 < 13.0.0 15.5.21
next.js >= 16.0.0, < 16.2.11 < 16.0.0, 16.2.11