Next.js Patches 9 Flaws, Including Critical SSRF and Auth Bypass

Key Takeaways

• Vercel has released patches for nine security flaws impacting Next.js, a widely adopted React framework.
• The vulnerabilities include critical Server-Side Request Forgery (SSRF) issues and an authentication bypass, alongside multiple Denial-of-Service (DoS) and data exposure risks.
• All nine issues were identified by security researcher KarimPwnz and are now resolved in Next.js versions 15.5.21 and 16.2.11.
• Organizations utilizing older Next.js versions (13.x, 14.x) must upgrade to a supported and patched release, as direct fixes for these older branches will not be provided.

Vercel has addressed a series of nine security vulnerabilities within Next.js, its popular React framework, releasing patches that resolve critical issues ranging from Server-Side Request Forgery (SSRF) to authentication bypasses and Denial-of-Service (DoS) conditions. These patches also mitigate risks of sensitive data exposure.

The disclosures, which encompass all nine advisories, were made two days ago following research by KarimPwnz. The fixes are now incorporated into Next.js versions 15.5.21 and 16.2.11. This comprehensive update aligns with Next.js’s recently announced initiative to implement a monthly security release program to proactively manage vulnerabilities across its supported framework versions.

Next.js Patches Multiple Vulnerabilities

High-Severity Flaws Addressed

Among the most severe issues is a high-severity SSRF vulnerability, tracked as CVE-2026-64645 (GHSA-p9j2-gv94-2wf4), affecting the framework’s rewrites feature. This flaw could allow an attacker to manipulate a destination hostname, compelling the server to initiate requests to arbitrary internal network endpoints. The vulnerability impacts Next.js versions 12.0.0 through 15.5.21 and 16.0.0 through 16.2.11, specifically when a rewrites() or redirects() rule constructs its destination hostname using user-controlled request data.

Another significant SSRF vulnerability, CVE-2026-64649 (GHSA-89xv-2m56-2m9x), also rated as high-severity, affects Server Actions operating on custom Node.js servers. Attackers could exploit this to redirect outbound Server Action requests to a server they control.

An authentication bypass vulnerability, CVE-2026-64642 (GHSA-6gpp-xcg3-4w24), was also patched. This flaw enables a middleware and proxy bypass in App Router applications using Turbopack builds with legacy middleware.ts and single-locale i18n configurations, potentially allowing attackers to circumvent authorization checks. Completing the list of high-severity issues is CVE-2026-64641 (GHSA-m99w-x7hq-7vfj), which could lead to Denial-of-Service conditions in App Router applications through maliciously crafted Server Actions requests.

Moderate-Severity Vulnerabilities

The update also addresses two moderate-severity DoS vulnerabilities. CVE-2026-64646 (GHSA-4c39-4ccg-62r3) concerns unbounded Server Action payloads within the Edge runtime, which could result in memory exhaustion. Additionally, CVE-2026-64644 (GHSA-q8wf-6r8g-63ch) allows attackers to crash the Image Optimization API by submitting malicious SVG files.

Two moderate-severity cache confusion bugs, CVE-2026-64648 (GHSA-68g3-v927-f742) and CVE-2026-64647 (GHSA-4633-3j49-mh5q), were also fixed. These vulnerabilities could lead to mixed-up response bodies between different requests when applications utilize cached fetch() calls with request bodies, including those containing invalid UTF-8 byte sequences. This scenario could result in one user’s data being inadvertently served to another under specific caching configurations. Finally, CVE-2026-64643 (GHSA-955p-x3mx-jcvp), another moderate issue, involves the exposure of internal Server Function endpoint identifiers to unauthenticated attackers when Cache Components are used in conjunction with reflective Server Actions. Vercel clarified that this leak is limited to opaque identifiers and does not expose credentials or personal data.

Affected Versions and Mitigations

The vulnerabilities span a wide range of the Next.js ecosystem, with affected versions starting as early as 12.0.0 for the rewrites SSRF flaw and 13.0.0 for several DoS and cache-related issues. It is important to note that older major versions, specifically 13.x and 14.x, will not receive direct patches. Organizations still running these versions must upgrade to a fixed 15.x or 16.x release to ensure security.

What You Should Do

• Immediately upgrade your Next.js applications to version 15.5.21 or 16.2.11 to apply all available security patches.
• For applications running on Next.js 13.x or 14.x, a direct upgrade to a patched 15.x or 16.x release is mandatory, as these older versions will not receive security updates.
• Conduct an audit of your application configurations, paying close attention to implementations of rewrites, custom servers, Turbopack middleware, and Cache Components, to assess your specific exposure to these vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.