The issue in Next.js versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10 allows an attacker to trigger excessive memory consumption in server‑side code that runs within the Edge runtime. When an App Router–based application includes at least one Server Action, a request with a large payload can cause the runtime to allocate an unbounded amount of memory, leading to a denial‑of‑service condition by exhausting the server's resources. This vulnerability is a classic instance of uncontrolled resource consumption (CWE‑770).

Affected systems are applications built with Vercel Next.js in the specified version ranges. The unsafe behaviour manifests when the App Router and Server Actions feature is used together with the Edge runtime. Users of Next.js 15.5.21 onward and 16.2.11 onward are no longer affected because the bug has been fixed in those releases.

The CVSS score of 6.3 indicates a medium severity risk, and an EPSS score of < 1%, indicating a very low probability of exploitation, is available. However, because the vulnerability can be triggered by any external HTTP request to a vulnerable Server Action, it is reasonable to assume the attack vector is remote. The impact is local to the host running the next.js application and can result in memory exhaustion leading to reduced service availability. The vulnerability is not reported in the CISA KEV catalog, but monitoring and patching remain essential.