Allocation of Resources Without Limits or Throttling Affecting next package, versions >=13.0.0 <15.5.21>=16.0.0 <16.2.11

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handleAction Server Actions path in the App Router Edge runtime. An attacker can exhaust server memory by sending an oversized Server Action request, especially a multipart form submission, because the Edge handler reads the full body without enforcing serverActions.bodySizeLimit. This can crash or destabilize affected deployments and prevent legitimate Server Action requests from being processed.

Notes

• Affected deployments need App Router pages with at least one Server Action running in the Edge runtime; the issue is in that execution path rather than in Server Actions generally.
• The advisory’s practical ceiling is tied to hosting-side request body limits: if the platform does not cap uploads, an oversized multipart action request can still drive memory growth before application code sees it.

Workarounds

• Limit Server Actions request bodies at your hosting provider to 5 MiB maximum, so oversized multipart submissions cannot reach the Edge runtime and trigger excessive memory use.

• GitHub Commit
• GitHub Commit
• Maintainer's Advisory