Vercel has taken significant steps to enhance the security of Next.js, a popular React framework, by releasing patches for nine identified vulnerabilities. These flaws, if exploited, could lead to server-side request forgery (SSRF), authentication bypass, denial-of-service (DoS) attacks, and exposure of sensitive data.
Security researcher KarimPwnz made these vulnerabilities public two days ago, prompting Vercel to address and resolve them in the latest Next.js versions 15.5.21 and 16.2.11.
In a proactive move, Next.js had previously announced the initiation of a monthly security release program, aimed at fortifying the framework against potential threats, which includes addressing the current vulnerabilities.
Critical Flaws and Their Impact
The most severe of these vulnerabilities is identified as CVE-2026-64645. This high-risk SSRF issue concerns the rewrites feature of Next.js, where an attacker can manipulate the server to send requests to unintended internal endpoints. This affects versions 12.0.0 through 15.5.21 and 16.0.0 through 16.2.11, especially when the destination hostname is derived from user inputs.
Another significant SSRF vulnerability, CVE-2026-64649, affects Server Actions on custom Node.js servers. This flaw enables attackers to redirect server requests to malicious hosts they control.
CVE-2026-64642 introduces a risk where attackers can bypass middleware and proxy checks in App Router applications using Turbopack builds. This could result in unauthorized access by circumventing security checks.
Other Notable Vulnerabilities
The list of high-severity vulnerabilities also includes CVE-2026-64641, which allows denial-of-service conditions through malicious Server Actions requests in App Router applications.
Two moderate-severity DoS vulnerabilities, CVE-2026-64646 and CVE-2026-64644, involve unbounded payloads and malicious SVG files, respectively, which can lead to memory exhaustion and crash the Image Optimization API.
Additional moderate issues, such as CVE-2026-64648 and CVE-2026-64647, involve cache confusion bugs that can inadvertently mix response bodies between requests. CVE-2026-64643 exposes internal identifiers through Cache Components and Server Actions, although this does not leak sensitive personal data.
Recommended Actions for Users
The vulnerabilities affect a wide range of Next.js versions, starting from version 12.0.0. Organizations using older major versions, such as 13.x and 14.x, must upgrade to the latest patched releases, 15.5.21 or 16.2.11, to ensure security.
Security teams are advised to promptly update their Next.js installations and review configurations, particularly for rewrites, custom servers, and middleware, to assess exposure and mitigate risks.
The recent security updates underscore the importance of maintaining a vigilant approach to software security in dynamic frameworks like Next.js. By upgrading and auditing their systems, organizations can protect their applications from these vulnerabilities.
