CVE-2026-27977 Details
Description
Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured `allowedDevOrigins` still allow connections from any origin. The issue is fixed in version 16.1.7 by validating `Origin: null` through the same cross-site origin-allowance checks used for other origins. If upgrading is not immediately possible, do not expose `next dev` to untrusted networks and/or block websocket upgrades to `/_next/webpack-hmr` when `Origin` is `null` at the proxy.
A vulnerability in Next.js versions 16.0.1 prior to 16.1.7 allows cross-site connections to internal WebSocket endpoints in development mode. The issue arises because the framework could incorrectly treat 'Origin: null' as a valid bypass, even when 'allowedDevOrigins' is set. This flaw enables privacy-sensitive contexts, such as sandboxed documents, to connect unexpectedly. As a result, if a development server is accessible from attacker-controlled content, an attacker might intercept and interact with the Hot Module Replacement (HMR) WebSocket traffic.
Users can upgrade to Next.js version 16.1.7 or later, where this vulnerability is fixed. If an immediate upgrade is not possible, Next.js should not be exposed to untrusted networks, and WebSocket upgrades to '/_next/webpack-hmr' should be blocked at the proxy when the 'Origin' header is null.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1385 | Missing Origin Validation in WebSockets | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vercel next.js | >= 16.0.1, < 16.1.7 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Mar 18, 2026 | CVE Modified | [email protected] |
| Mar 18, 2026 | New CVE Received | [email protected] |