Executive brief
Next.js is a popular web application framework used to build dynamic websites and applications. The framework's Server Actions feature, which allows secure server-side operations, contained a flaw in its cross-site request forgery (CSRF) protection. An attacker could trick a victim's browser into executing state-changing operations (such as modifying data or accounts) by exploiting this vulnerability through sandboxed contexts, bypassing the application's built-in security checks.
Technical details
Next.js Server Actions CSRF validation treated a null origin (common in opaque contexts like sandboxed iframes) as a "missing" origin rather than an explicit origin value, allowing it to bypass origin verification checks. The vulnerability affects versions 16.0.1 through 16.1.6. An attacker could craft a malicious page containing a sandboxed iframe that induces a victim's browser to submit Server Actions, causing state-changing operations to execute with the victim's credentials. The issue was fixed in version 16.1.7 by treating 'null' as an explicit origin and enforcing strict host/origin checks unless 'null' is explicitly allowlisted in serverActions.allowedOrigins configuration.
Affected products
- Vercel Next.js >=16.0.1, <16.1.7
Timeline
- 2026-03-16: disclosed
- 2026-03-17: patched: Version 16.1.7 released