Next.js Patches Nine Security Flaws Enabling SSRF, Middleware Bypass, DoS, and Internal Endpoint Disclosure

The Next.js team has released security updates that address nine vulnerabilities affecting the App Router, Server Actions, rewrites, image optimization, caching, and middleware deployments.

Organizations are urged to upgrade to Next.js versions 15.5.21 or 16.2.11 immediately, as these updates fix high- and moderate-severity flaws that could lead to server-side request forgery (SSRF), authentication bypass, denial of service (DoS), cache-based data exposure, and reconnaissance of Server Function endpoints.

Next.js Patches Nine Security Flaws

The most severe vulnerabilities include CVE-2026-64645, which is an SSRF flaw in the `rewrites()` and `redirects()` configurations. This vulnerability allows user-controlled values to set an external destination hostname.

An attacker could manipulate the hostname beyond its intended suffix, causing a vulnerable Next.js server to proxy requests to attacker-chosen destinations or internal network locations.

While `rewrites` can enable SSRF, similarly insecure redirects can create open-redirect conditions. Teams unable to apply the patch immediately should avoid constructing external destination hostnames from untrusted input and should restrict dynamic host segments to safe characters such as [a-z0-9-]+.

Another issue, CVE-2026-64649, introduces an SSRF vector that affects Server Actions deployed on custom servers or configurations where incoming Host-related headers are not secured to a trusted origin. In some cases, this vulnerability could expose internal values relevant to middleware or proxy authorization.

Managed hosting environments that secure the host upstream are not affected. However, self-hosted teams should validate Host and X-Forwarded-Host headers at the edge and, where applicable, configure a fixed private origin.

The release also addresses CVE-2026-64642, a high-severity middleware and proxy bypass vulnerability that affects App Router applications compiled with Turbopack and using a single `i18n.locales` entry.

Maliciously crafted requests could bypass middleware-based authentication and security checks. Additionally, CVE-2026-64641 can cause excessive CPU consumption in App Router applications that expose at least one Server Action, blocking further requests handled by the same process.

Three moderate-severity vulnerabilities impact data handling and availability. CVE-2026-64648 and CVE-2026-64647 are related to cache confusion in server-side fetch operations involving request bodies, potentially returning cached response bodies from different requests and exposing confidential POST-response data.

The latter case specifically involves issues with invalid UTF-8 processing. CVE-2026-64646 allows for excessive memory consumption due to unbounded Server Action payloads in the Edge runtime.

CVE-2026-64643 exposes identifiers for App Router Server Actions and cache endpoints to unauthenticated users, creating a useful reconnaissance tool for chained attacks.

CVE-2026-64644 affects self-hosted deployments using the default Image Optimization API with allowed remote images, where malicious SVG content can trigger CPU exhaustion at the /_next/image endpoint. Vercel-hosted applications, custom image loaders, and deployments with `images.unoptimized: true` are not affected by this vulnerability.image issue.

CVE Details

CVE	Severity	Vulnerability	Affected versions	Fixed version
CVE-2026-64641	High	DoS in App Router Server Actions	>=13.0.0 to <15.5.21; >=16.0.0 to <16.2.11	15.5.21, 16.2.11
CVE-2026-64642	High	Middleware/proxy authorization bypass with Turbopack and single locale	>=16.0.0 to <16.2.11	16.2.11
CVE-2026-64643	Moderate	Unauthenticated disclosure of Server Function endpoint IDs	>=13.0.0 to <15.5.21; >=16.0.0 to <16.2.11	15.5.21, 16.2.11
CVE-2026-64644	Moderate	SVG-driven Image Optimization API DoS	>=15.5.0 to <15.5.21; >=16.0.0 to <16.2.11	15.5.21, 16.2.11
CVE-2026-64645	High	SSRF through attacker-controlled rewrite/redirect hostname	>=12.0.0 to <15.5.21; >=16.0.0 to <16.2.11	15.5.21, 16.2.11
CVE-2026-64646	Moderate	Unbounded Server Action payload in Edge runtime	>=13.0.0 to <15.5.21; >=16.0.0 to <16.2.11	15.5.21, 16.2.11
CVE-2026-64647	Moderate	Cache confusion involving invalid UTF-8 request bodies	>=13.0.0 to <15.5.21; >=16.0.0 to <16.2.11	15.5.21, 16.2.11
CVE-2026-64648	Moderate	Cache confusion for fetch requests with different bodies	>=13.0.0 to <15.5.21; >=16.0.0 to <16.2.11	15.5.21, 16.2.11
CVE-2026-64649	High	SSRF in Server Actions on custom servers	>=14.1.1 to <15.5.21; >=16.0.0 to <16.2.11	15.5.21, 16.2.11

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.