CVE-2026-64649
Received Received - Intake

Server-Side Request Forgery in Next.js Framework

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-28
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-64649
EUVD
EUVD-2026-49571

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
vercel next.js From 14.1.1 (inc) to 15.5.20 (inc)
vercel next.js From 16.0.0 (inc) to 16.2.10 (inc)
vercel next.js 15.5.21
vercel next.js 16.2.11
vercel next.js From 14.1.1 (inc) to 14.2.0 (inc)
vercel next.js From 15.0.0 (inc) to 15.5.20 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Next.js Server Actions. When a Server Action forwards or redirects a request, an attacker can manipulate the Host header to send outbound requests to malicious hosts. This happens in custom server setups where the Host header is not properly validated. The vulnerability affects Next.js versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10.

Detection Guidance

To detect this SSRF vulnerability in Next.js Server Actions, inspect network traffic for outbound requests with manipulated Host headers. Check logs for requests originating from Server Actions that redirect to unexpected hosts. Use tools like tcpdump or Wireshark to monitor outbound connections from your Next.js server. Look for requests with Host headers that do not match your application's domain.

Impact Analysis

An attacker could exploit this to send unauthorized requests to internal systems, bypass security controls, or access sensitive data. In some cases, internal values that weaken middleware or proxy authorization may be exposed. The impact depends on the server configuration and whether the Host header is controlled by the attacker.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations must address this to maintain compliance, especially if handling sensitive data.

Mitigation Strategies

Upgrade Next.js to versions 15.5.21 or 16.2.11 or later. If upgrading is not possible, pin or validate the Host and X-Forwarded-Host headers at the edge or proxy level. For custom servers, set the __NEXT_PRIVATE_ORIGIN environment variable to your deployment's real origin. Ensure your proxy or hosting provider pins the Host header upstream to prevent manipulation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart