CVE-2026-64643
Received Received - Intake

Authentication Bypass in Next.js App Router

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-64643
EUVD
EUVD-2026-49383

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
vercel next.js From 12.0.0 (inc) to 15.5.20 (inc)
vercel next.js From 16.0.0 (inc) to 16.2.10 (inc)
vercel next.js From 16.0.0 (inc) to 16.2.11 (exc)
vercel next.js 15.5.21
vercel next.js 16.2.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Next.js applications using App Router, Server Actions or use cache endpoints. It allows unauthenticated users to disclose internal Server Function endpoints by exploiting publicly served client artifacts like static chunks containing action references. This reveals Server Action IDs to unauthorized parties, acting as a reconnaissance primitive.

Detection Guidance

Check Next.js application versions for affected ranges (>=13.0.0 <15.5.21 or >=16.0.0 <16.2.11). Inspect static client artifacts like JavaScript chunks for exposed Server Action IDs or references. Use browser developer tools to examine network requests for unauthorized access to server endpoints.

Impact Analysis

The impact includes exposure of sensitive endpoint information, increasing risk when combined with other weaknesses. Attackers could use disclosed Server Action IDs to probe for further vulnerabilities or unauthorized access. The attack requires no privileges or user interaction and is remotely exploitable with low complexity.

Compliance Impact

This vulnerability primarily exposes Server Action IDs to unauthenticated users, which could lead to unauthorized access to sensitive endpoints. For GDPR, this may violate principles of data protection by design and default (Article 25) if it results in unauthorized data exposure. For HIPAA, it could compromise the integrity of protected health information if endpoints handling such data are exposed.

Mitigation Strategies

Upgrade Next.js to patched versions (15.5.21 or 16.2.11 or later). Avoid relying on authentication at use cache or use server boundaries; implement authentication within those boundaries. Ensure consistent encryption keys across servers using NEXT_SERVER_ACTIONS_ENCRYPTION_KEY.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64643. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart