Vercel has disclosed nine security vulnerabilities in Next.js, the widely used React framework, including two critical-severity flaws that allow attackers to bypass authentication middleware and hijack server-side requests.
The advisories, published by researcher KarimPwnz, affect versions ranging from 12.0.0 through 16.2.10, with patches available in 15.5.21 and 16.2.11.
The most severe issue, tracked as CVE-2026-64642 (CVSS 4.0, High), affects App Router applications built with Turbopack that use a single locale entry in config.i18n.locales.
Critical Next.js Flaws
Crafted requests can bypass middleware and proxy-based authentication entirely, granting unauthorized access to protected routes (CWE-285: Improper Authorization).
Organizations relying solely on middleware for access control should treat this as urgent and enforce authorization checks directly in the server-side data path as an interim mitigation.
CVE-2026-64645 (CVSS 4.0, High) impacts rewrites() and redirects() configurations that build destination hostnames from request-controlled input, such as dynamic path segments or has captures.
Attackers can redirect the hostname to an arbitrary destination, causing Next.js to proxy requests to malicious hosts while serving responses from the application’s own origin, a textbook SSRF (CWE-918).
A related flaw, CVE-2026-64649, affects Server Actions on custom servers where the Host header isn’t pinned, similarly enabling SSRF and potential internal value disclosure. Vercel-managed hosting and standard next start deployments from 14.2 onward are not affected.
Denial-of-Service and Cache Confusion Issues
Several moderate-to-high severity bugs round out the disclosure:
| CVE ID | Severity | Vulnerability | CWE |
|---|---|---|---|
| CVE-2026-64641 | High | App Router Server Actions can trigger excessive CPU usage, blocking request processing | CWE-834 |
| CVE-2026-64646 | Moderate | Server Actions on the Edge runtime lack payload size limits, enabling memory exhaustion | CWE-770 |
| CVE-2026-64644 | Moderate | Image Optimization API can be abused via malicious remote SVGs to exhaust CPU resources | No CWE assigned |
| CVE-2026-64648 | Moderate | Cache confusion in server-side fetch() calls leaks confidential response bodies across unrelated requests | No CWE assigned |
| CVE-2026-64647 | Moderate | Cache confusion variant triggered by invalid UTF-8 byte sequences in request bodies | CWE-116 |
| CVE-2026-64643 | Moderate | Server Action IDs disclosed through public client-side chunks, aiding reconnaissance against use server and use cache boundaries | CWE-201 |
According to KarimPwnz advisory, urges all users to upgrade immediately to Next.js 15.5.21 or 16.2.11, depending on their major version track.
If upgrading isn’t immediately possible, teams should restrict dynamic hostnames in rewrite/redirect rules, pin the Host and X-Forwarded-Host headers at the proxy layer, limit Edge Server Action payload sizes, and validate authentication explicitly within use server and use cache boundaries.
Since this batch combines an authentication bypass with multiple SSRF flaws, patching should take priority over workarounds for self-hosted or custom-server deployments.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
