CVE-2026-64649 Details

A server-side request forgery (SSRF) vulnerability has been identified in Next.js, a React framework for building full-stack web applications. This issue affects versions 14.1.1 prior to 15.5.20 and 16.0.0 prior to 16.2.10. The vulnerability arises when a Server Action forwards or redirects a request, allowing an attacker to manipulate the request's Host-associated headers and direct it to a malicious host. In some cases, this could also expose internal values that undermine middleware or proxy authorization. The vulnerability is present in applications using Server Actions on custom servers or deployments not behind a proxy that secures the host header. Managed hosting services that pin the host are not affected, and Next.js versions 14.2.0 and later address this issue in standard and standalone outputs.

Users can upgrade to Next.js versions 15.5.21 or 16.2.11, both of which include the necessary security fix. If an upgrade is not possible, ensure that the host header received by the application is not controlled by clients. It is recommended to pin or validate the 'Host' and 'X-Forwarded-Host' headers at the edge or proxy. For Next.js versions 14.2.0 and later, the '__NEXT_PRIVATE_ORIGIN' environment variable can be set to the application's real origin before starting the server.