Vercel has recently released updates for Next.js, a widely adopted React framework, to address nine security vulnerabilities. These flaws, if exploited, could lead to server-side request forgery (SSRF), authentication bypasses, denial-of-service (DoS) attacks, and exposure of sensitive data. The issues have been resolved in Next.js versions 15.5.21 and 16.2.11.
Details of the Vulnerabilities
The most critical vulnerability, identified as CVE-2026-64645, involves SSRF within the rewrites feature. This flaw allows attackers to manipulate the destination hostname, potentially causing the server to make requests to unintended internal endpoints. This issue affects Next.js versions from 12.0.0 up to 15.5.21 and from 16.0.0 to 16.2.11, particularly when rewrites() or redirects() rules incorporate user-supplied data.
Another significant SSRF vulnerability, CVE-2026-64649, impacts Server Actions on custom Node.js servers. Attackers could exploit this to redirect outbound Server Action requests to a host under their control.
CVE-2026-64642 presents a middleware and proxy bypass risk in App Router applications utilizing Turbopack builds with legacy middleware.ts and single-locale i18n configurations. This could allow unauthorized users to circumvent authentication checks.
Additionally, CVE-2026-64641 enables attackers to induce DoS conditions in App Router applications through malicious Server Actions requests.
Moderate-severity issues include CVE-2026-64646, which involves unbounded Server Action payloads in the Edge runtime that can exhaust memory, and CVE-2026-64644, where malicious SVG files can crash the Image Optimization API.
Two cache confusion vulnerabilities, CVE-2026-64648 and CVE-2026-64647, may result in response bodies being incorrectly served between different requests when applications use cached fetch() calls with request bodies, including those containing invalid UTF-8 sequences.
Lastly, CVE-2026-64643 exposes internal Server Function endpoint identifiers to unauthenticated users when Cache Components are used alongside reflective Server Actions. However, the exposure is limited to opaque identifiers, not credentials or personal data.
Impacted Versions and Recommended Actions
The vulnerabilities affect a broad range of Next.js versions, starting from 12.0.0 for the rewrites SSRF flaw and from 13.0.0 for several DoS and cache issues. Notably, older major versions such as 13.x and 14.x will not receive direct patches. Organizations using these versions must upgrade to a fixed 15.x or 16.x release to mitigate the risks.
Given the severity of these vulnerabilities, it is imperative for developers and organizations to promptly update their Next.js installations to versions 15.5.21 or 16.2.11. Additionally, reviewing and adjusting configurations related to rewrites, custom servers, Turbopack middleware, and Cache Components is crucial to ensure comprehensive protection against potential exploits.
These security updates underscore the importance of maintaining up-to-date software and regularly reviewing application configurations. As web frameworks like Next.js continue to evolve, staying vigilant about security advisories and promptly applying patches is essential to safeguard applications and user data.
