GHSA-4c39-4ccg-62r3Medium
Next.js: Unbounded Server Action payload in Edge runtime
🔗 CVE IDs covered (1)
📋 Description
Impact
Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime
Workarounds
If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.
🎯 Affected products2
- npm/next:>= 13.0.0, < 15.5.21
- npm/next:>= 16.0.0, < 16.2.11
🔗 References (6)
- https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3
- https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4
- https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17
- https://github.com/vercel/next.js/releases/tag/v15.5.21
- https://github.com/vercel/next.js/releases/tag/v16.2.11
- https://github.com/advisories/GHSA-4c39-4ccg-62r3