CVE-2026-64646: Vercel Next.js DOS Vulnerability

CVE-2026-64646 Overview

CVE-2026-64646 is a resource exhaustion vulnerability [CWE-770] in Next.js, the React framework maintained by Vercel for building full-stack web applications. The flaw affects applications using the App Router with at least one Server Action configured to run on the Edge runtime. Attackers can send crafted network requests to trigger excessive memory consumption on the server, degrading application availability. The issue impacts Next.js versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10. Vercel published fixes in versions 15.5.21 and 16.2.11.

Critical Impact
Unauthenticated remote attackers can exhaust server memory on Next.js applications that expose Server Actions on the Edge runtime, leading to denial of service.

Affected Products

Vercel Next.js 13.0.0 through 15.5.20
Vercel Next.js 16.0.0 through 16.2.10
Applications using App Router with at least one Server Action on the Edge runtime

Discovery Timeline

2026-07-27 - CVE-2026-64646 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-64646

Vulnerability Analysis

CVE-2026-64646 is classified as Allocation of Resources Without Limits or Throttling [CWE-770]. The vulnerability resides in how the Next.js App Router processes incoming requests that target Server Actions running on the Edge runtime. When such a request is received, the runtime allocates memory during request handling without enforcing sufficient bounds on the data it accepts. Repeated or oversized requests cause memory to accumulate, degrading service and potentially exhausting available resources on the hosting environment.

The scope is limited to applications that both use the App Router and declare at least one Server Action bound to the Edge runtime. Applications that use only the Node.js runtime for Server Actions, or that do not define Server Actions at all, are not affected by this specific issue.

Root Cause

The root cause is missing enforcement of resource limits on Server Action request handling within the Edge runtime code path. According to the GitHub Security Advisory GHSA-4c39-4ccg-62r3, the fix was delivered through two upstream commits, 57c31f7 and 9a4651e, which introduce proper handling and limits for the affected request path.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends HTTP requests targeting a route handled by the App Router that exposes at least one Edge-runtime Server Action. By repeating or shaping these requests, the attacker forces the server to allocate memory beyond expected bounds. The result is a denial-of-service condition against the Next.js application, with no direct impact on confidentiality or integrity.

The vulnerability manifests during Server Action request handling on the Edge runtime. See the GitHub Security Advisory GHSA-4c39-4ccg-62r3 for technical details on the affected code paths.

Detection Methods for CVE-2026-64646

Indicators of Compromise

Sustained increases in memory utilization on Edge runtime workers hosting Next.js Server Actions
Elevated request rates or unusually large request bodies directed at App Router Server Action endpoints
Application restarts, out-of-memory events, or platform-level worker recycling correlated with Server Action traffic
HTTP 5xx responses returned from Server Action routes during traffic spikes

Detection Strategies

Inventory all Next.js deployments and identify applications running versions 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10
Enumerate Server Actions configured with export const runtime = 'edge' in the App Router codebase
Correlate hosting platform memory metrics with access logs to identify anomalous Server Action request patterns
Baseline normal Server Action payload sizes and alert on statistical outliers

Monitoring Recommendations

Track memory, CPU, and cold-start metrics from the Edge runtime environment (Vercel, self-hosted, or other providers)
Alert on repeated POST requests to Server Action endpoints from a single source or narrow set of sources
Log request Content-Length distributions for App Router routes and flag deviations
Forward web server and platform runtime logs to a centralized analytics system for correlation with resource metrics

How to Mitigate CVE-2026-64646

Immediate Actions Required

Upgrade Next.js to version 15.5.21 or 16.2.11, matching the current major version in use
If upgrading immediately is not feasible, migrate affected Server Actions from the Edge runtime to the Node.js runtime
Deploy rate limiting and request size limits in front of Next.js applications at the CDN, WAF, or reverse proxy layer
Audit the codebase for any file exporting runtime = 'edge' alongside Server Actions and prioritize those routes

Patch Information

Vercel released patched versions Next.js v15.5.21 and Next.js v16.2.11. The fixes are delivered through commits 57c31f7 and 9a4651e. Consult the GHSA-4c39-4ccg-62r3 advisory for full remediation guidance.

Workarounds

Switch affected Server Actions from the Edge runtime to the Node.js runtime until patched versions can be deployed
Enforce request body size limits and rate limits at the edge or reverse proxy protecting the application
Restrict exposure of Server Action routes with authentication or network-level controls where the business logic allows

bash

# Upgrade Next.js to a patched version using npm
npm install next@15.5.21
# or, for the 16.x release line
npm install next@16.2.11

# Verify the installed version
npx next --version