MEDIUM
GHSA-4c39-4ccg-62r3
Next.js: Unbounded Server Action payload in Edge runtime
Quick fix
GHSA-4c39-4ccg-62r3 — next: upgrade to the fixed version with the command below.
npm install next@15.5.21Details
## Impact
Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime
## Workarounds
If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3 [WEB]
- https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4 [WEB]
- https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17 [WEB]
- https://github.com/vercel/next.js [PACKAGE]
- https://github.com/vercel/next.js/releases/tag/v15.5.21 [WEB]
- https://github.com/vercel/next.js/releases/tag/v16.2.11 [WEB]