Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-27978 is a moderate severity vulnerability in the Next.js framework affecting versions from 16.0.1 up to but not including 16.1.7. The issue arises because the origin value "null" was incorrectly treated as a missing origin during Server Actions Cross-Site Request Forgery (CSRF) validation.'}, {'type': 'paragraph', 'content': "This flaw allowed requests originating from opaque contexts, such as sandboxed iframes, to bypass origin verification checks instead of being recognized as cross-origin requests. As a result, an attacker could trick a victim's browser into submitting Server Actions from a sandboxed context, potentially executing state-changing actions with the victim's credentials."}, {'type': 'paragraph', 'content': 'The vulnerability was fixed in version 16.1.7 by explicitly treating "null" as a valid origin value and enforcing strict host/origin checks unless "null" is explicitly allowlisted in the experimental configuration parameter `experimental.serverActions.allowedOrigins`.'}] [1, 2]

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability can allow an attacker to perform Cross-Site Request Forgery (CSRF) attacks by inducing a victim's browser to submit Server Actions from a sandboxed or opaque context. This means unauthorized state-changing actions could be executed using the victim's credentials without their consent."}, {'type': 'paragraph', 'content': 'The impact includes unauthorized changes to application state, potentially leading to data manipulation or other unintended side effects. However, it does not impact confidentiality or availability.'}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "Detection of this vulnerability involves monitoring for Server Action requests originating from opaque contexts such as sandboxed iframes where the origin header is 'null'. Such requests bypass origin verification in vulnerable versions of Next.js."}, {'type': 'paragraph', 'content': "You can inspect HTTP requests to your Next.js server for requests with an origin header set to 'null' or missing, which should normally be rejected or carefully validated."}, {'type': 'paragraph', 'content': "Example commands to detect suspicious requests include using network traffic capture tools like tcpdump or Wireshark to filter HTTP requests with origin 'null':"}, {'type': 'list_item', 'content': "tcpdump -i any -A -s 0 'tcp port 80 or tcp port 443' | grep -i 'Origin: null'"}, {'type': 'list_item', 'content': "Using curl to simulate a request with origin 'null' to test server response: curl -H 'Origin: null' -X POST https://your-nextjs-app/api/server-action"}, {'type': 'paragraph', 'content': 'Additionally, reviewing server logs for warnings about missing or mismatched origin headers can help identify attempts to exploit this vulnerability.'}] [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': "The primary mitigation is to upgrade Next.js to version 16.1.7 or later, where the vulnerability is fixed by explicitly treating 'null' as a valid origin and enforcing strict host/origin checks."}, {'type': 'paragraph', 'content': 'If upgrading immediately is not possible, apply the following workarounds:'}, {'type': 'list_item', 'content': 'Add CSRF tokens to sensitive Server Actions to ensure requests are validated beyond origin checks.'}, {'type': 'list_item', 'content': 'Set sensitive authentication cookies with the SameSite=Strict attribute to prevent them from being sent in cross-origin requests.'}, {'type': 'list_item', 'content': "Avoid allowing 'null' in the configuration parameter experimental.serverActions.allowedOrigins unless absolutely necessary and ensure additional protections are in place if it is allowed."}] [1]

Useful 0 Not Useful 0