← Vulnerability feed

Vulnerability record · CVE-2026-64649 · published 27 July 2026

CVE-2026-64649: Vercel next.js server-side request forgery (ssrf) vulnerability

Vercel · Next.Js

Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11.

8.3 CVSS 4.0 High EPSS 0.46% · top 62.7% CWE-918 · Server-side request forgery (SSRF)
8.3CVSS 4.0 base score
0.46%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References
29 Jul 2026Last modified by NVD

Description

Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b Patch
https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498 Patch
https://github.com/vercel/next.js/releases/tag/v15.5.21 ProductRelease Notes
https://github.com/vercel/next.js/releases/tag/v16.2.11 ProductRelease Notes
https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x MitigationVendor Advisory

Track CVE-2026-64649 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2025-55182React Server Components pre-auth deserialization RCEReact Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) u…KEVEPSS 100%analysed9.1CVE-2025-29927Next.js middleware authorization bypass via x-middleware-subrequest headerNext.js versions from 1.11.4 up to (but not including) 12.3.5, 13.5.9, 14.2.25, and 15.2.3 allow authorization checks performed in middleware to be b…EPSS 99%analysed8.6CVE-2026-44578Vercel next.js server-side request forgery (ssrf) vulnerabilityNext.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the …EPSS 1.9%8.3CVE-2026-64642Vercel next.js improper authorization vulnerabilityNext.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applica…EPSS 0.64%8.3CVE-2026-64645Vercel next.js open redirect vulnerabilityNext.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or…EPSS 0.41%8.2CVE-2026-64641Vercel next.js vulnerabilityNext.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted request…EPSS 0.86%8.2CVE-2025-57822Vercel next.js server-side request forgery (ssrf) vulnerabilityNext.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly …EPSS 2.5%8.1CVE-2026-44574Vercel next.js authentication bypass via alternate path vulnerabilityNext.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware…EPSS 0.67%

Source: NIST National Vulnerability Database (record CVE-2026-64649), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.