CVE-2026-64646: 
Wolfi vulnerability analysis and mitigation

CVE-2026-64646 is a Denial of Service vulnerability in Vercel's Next.js React framework, described as an "Unbounded Server Action payload in Edge runtime." It affects Next.js versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10 when using the App Router with at least one Server Action configured to use the Edge runtime. The vulnerability was published on July 22, 2026, and patched in versions 15.5.21 and 16.2.11. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Next.js v15.5.21 Release).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling). In the affected versions, the handleAction function in packages/next/src/server/app-render/action-handler.ts contained a // TODO: add body limit comment for the Edge runtime code path, meaning the serverActions.bodySizeLimit configuration was never enforced when Server Actions ran under the Edge runtime — unlike the Node.js runtime path which did apply the limit. An unauthenticated attacker can send arbitrarily large HTTP POST request bodies (multipart or non-multipart) to any Server Action endpoint using the Edge runtime, causing the server to buffer the entire payload in memory without restriction. The fix enforces the configured bodySizeLimit (defaulting to 1 MB) by tracking cumulative byte size during stream reading and throwing an HTTP 413 error upon exceeding the limit (GitHub Advisory, Patch Commit 15.x, Patch Commit 16.x).

Successful exploitation causes excessive memory consumption on the affected Next.js server, potentially leading to service degradation or a complete crash (denial of service). There is no impact on confidentiality or integrity — the vulnerability is limited to availability. Applications relying on Edge runtime Server Actions are at risk of becoming unresponsive under sustained attack, affecting all users of the service (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is network-accessible and requires no authentication, but exploitation requires the target application to have at least one Server Action using the Edge runtime (Attack Requirements: Present in CVSS v4.0). The EPSS score is approximately 0.53%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" (Feedly).

1. Reconnaissance: Identify Next.js applications running versions 13.0.0–15.5.20 or 16.0.0–16.2.10 using App Router. Look for publicly exposed endpoints that invoke Server Actions (typically POST requests to page routes with Next-Action headers).
2. Confirm Edge runtime usage: Determine whether any Server Action on the target uses the Edge runtime (e.g., pages with export const runtime = 'edge' and 'use server' functions). This may be inferred from response headers or application behavior.
3. Craft oversized payload: Construct an HTTP POST request with a very large body (e.g., several hundred megabytes of multipart form data or raw body content) targeting the identified Server Action endpoint.
4. Send repeated requests: Repeatedly submit the oversized POST requests to the Edge runtime Server Action endpoint without authentication, causing the server to buffer each payload in memory without enforcing any size limit.
5. Achieve denial of service: Sustained submission of large payloads exhausts available server memory, causing the application to become unresponsive or crash (GitHub Advisory, Patch Commit 15.x).

• Network: Unusually large HTTP POST requests (multi-megabyte bodies) to Next.js App Router routes that handle Server Actions; requests containing Next-Action header targeting Edge runtime routes.
• Logs: Server logs showing repeated large POST requests to the same endpoint; absence of HTTP 413 responses from Server Action endpoints (expected behavior in unpatched versions); application error logs showing out-of-memory errors or crashes.
• Process: Sudden spikes in memory consumption by the Next.js server process; process restarts or OOM (out-of-memory) kills in container or hosting environment logs.
• Hosting/Infrastructure: Memory usage alerts from hosting providers (e.g., Vercel, Netlify) coinciding with high-volume POST traffic to specific routes.

Upgrade Next.js to version 15.5.21 (for the 13.x–15.x branch) or 16.2.11 (for the 16.x branch), which enforce serverActions.bodySizeLimit for Edge runtime Server Actions (Next.js v15.5.21 Release, Next.js v16.2.11 Release). If immediate patching is not possible, configure your hosting provider to enforce a maximum request body size of 5 MiB or less at the infrastructure level (GitHub Advisory). Additionally, consider implementing rate limiting on Server Action endpoints and monitoring memory usage to detect and respond to potential DoS attempts.

The vulnerability was part of a broader July 2026 Next.js security release that addressed nine security flaws, including higher-severity SSRF and authentication bypass issues, which drew significant coverage from security news outlets such as CyberSecurityNews, GBHackers, and SecureBulletin (CyberSecurityNews, GBHackers). Cloudflare and Netlify both published changelogs acknowledging the Next.js security vulnerabilities and their platform-level responses (Netlify Changelog). Community reaction was largely focused on the higher-severity issues in the same release batch; CVE-2026-64646 itself received moderate attention given its lower CVSS score and limited exploitation preconditions.