Allocation of Resources Without Limits or Throttling Affecting next package, versions >=13.0.0 <15.5.21>=16.0.0 <16.2.11
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-NEXT-18232299
- published23 Jul 2026
- disclosed22 Jul 2026
- creditUnknown
Introduced: 22 Jul 2026
NewCVE-2026-64646 (opens in a new tab)How to fix?
Upgrade next to version 15.5.21, 16.2.11 or higher.
Overview
next is a react framework.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handleAction Server Actions path in the App Router Edge runtime. An attacker can exhaust server memory by sending an oversized Server Action request, especially a multipart form submission, because the Edge handler reads the full body without enforcing serverActions.bodySizeLimit. This can crash or destabilize affected deployments and prevent legitimate Server Action requests from being processed.
Notes
- Affected deployments need App Router pages with at least one Server Action running in the Edge runtime; the issue is in that execution path rather than in Server Actions generally.
- The advisory’s practical ceiling is tied to hosting-side request body limits: if the platform does not cap uploads, an oversized multipart action request can still drive memory growth before application code sees it.
Workarounds
- Limit Server Actions request bodies at your hosting provider to 5 MiB maximum, so oversized multipart submissions cannot reach the Edge runtime and trigger excessive memory use.