CVE-2026-64646: 
Wolfi vulnerability analysis and mitigation

CVE-2026-64646 is a Denial of Service vulnerability in Next.js titled "Unbounded Server Action payload in Edge runtime." It affects Next.js applications using the App Router with at least one Server Action configured to use the Edge runtime, where request bodies are accepted without size limits, enabling excessive memory consumption. Affected versions are >= 13.0.0, < 15.5.21 and >= 16.0.0, < 16.2.11. The vulnerability was published on July 21–22, 2026, with patches released the same day. It carries a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the Edge runtime code path in Next.js's action-handler.ts previously called req.request.formData() directly — bypassing any configured serverActions.bodySizeLimit — and similarly lacked size enforcement for non-multipart bodies. This allowed an unauthenticated attacker to send arbitrarily large POST request bodies to any Server Action endpoint running on the Edge runtime, causing the runtime to buffer the entire payload in memory. The fix enforces serverActions.bodySizeLimit (defaulting to 1 MB) by reading the body stream in chunks and throwing an HTTP 413 error if the limit is exceeded, for both multipart and non-multipart payloads (GitHub Advisory, 15.x Commit, 16.x Commit).

Successful exploitation causes excessive memory consumption in the Next.js Edge runtime, potentially rendering the application unresponsive or crashing it entirely — a Denial of Service condition. There is no impact to confidentiality or integrity; only availability of the vulnerable system is affected. Because the Edge runtime is typically used for latency-sensitive, globally distributed workloads, even brief disruptions can have broad user-facing consequences (GitHub Advisory).

1. Reconnaissance: Identify Next.js applications using App Router with Edge runtime Server Actions. This can be inferred from public source code, framework-specific response headers (e.g., x-powered-by: Next.js), or by probing endpoints for Server Action behavior (POST requests with Next-Action headers).
2. Identify a Server Action endpoint: Locate a route that accepts POST requests and processes a Server Action in the Edge runtime. These endpoints typically respond to POST requests with a Next-Action header.
3. Craft an oversized payload: Prepare a large HTTP POST request body (e.g., a multipart form-data or JSON payload significantly exceeding 1 MB, up to several hundred MB or more) targeting the identified endpoint.
4. Send the request: Transmit the oversized POST request to the Server Action endpoint. On unpatched versions, the Edge runtime will buffer the entire body into memory without enforcing any size limit.
5. Trigger memory exhaustion: Repeat or parallelize requests to amplify memory pressure, causing the Edge runtime worker to exhaust available memory and become unresponsive or crash, resulting in a Denial of Service for legitimate users (GitHub Advisory, 15.x Commit).

• Network: Unusually large POST requests (well above 1–5 MB) to Next.js App Router routes that handle Server Actions; requests containing Next-Action header with oversized Content-Length values.
• Logs: Application or hosting provider logs showing repeated large POST requests to Edge runtime routes; error messages such as Error: Body exceeded <limit> limit or HTTP 500/413 responses from Server Action endpoints on patched versions.
• Process/Runtime: Sudden spikes in memory utilization of Edge runtime workers; worker crashes or restarts correlated with large inbound POST requests; application becoming unresponsive following a burst of large requests.

Upgrade Next.js to version 15.5.21 (for the 15.x branch) or 16.2.11 (for the 16.x branch) to apply the fix, which enforces serverActions.bodySizeLimit in the Edge runtime (Next.js v15.5.21 Release, Next.js v16.2.11 Release). If an immediate upgrade is not possible, configure your hosting provider or reverse proxy (e.g., Nginx, Cloudflare, API gateway) to limit incoming request body sizes to a maximum of 5 MiB for all routes (GitHub Advisory). Additionally, you can configure serverActions.bodySizeLimit in next.config.js to enforce a custom limit at the application level once on a patched version.

The Next.js team published a July 2026 security release blog post covering this and several other vulnerabilities patched in the same release cycle (Next.js Blog). Netlify acknowledged the vulnerabilities and published a changelog entry noting the Next.js security fixes (Netlify Changelog). Cloudflare's WAF team also noted the release in their changelog, indicating infrastructure-level awareness of the issue (Cloudflare Changelog).