CVE-2026-64643: Vercel Next.js authentication bypass in Server Function endpoints

CVE-2026-64643 · Severity: medium · CVSS 4 · Published 2026-07-27

Next.js is a popular framework used to build web applications. A vulnerability exists where internal identifiers for server-side functions can be leaked to unauthenticated users through public website files. While this does not directly grant access to private data, it allows attackers to discover and potentially interact with internal endpoints that were intended to be protected by authentication, increasing the risk of further attacks.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is CVE-2026-64643 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-64643 being exploited in the wild.
How severe is CVE-2026-64643?
Medium severity, with a CVSS score of 4, published 27 July 2026.
Which products and versions are affected?
next (npm) SEMVER:introduced=13.0.0,fixed=15.5.21; Vercel Next.js >= 12.0.0, < 15.5.21; >= 16.0.0, < 16.2.11, >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11.
Is there a fix for CVE-2026-64643?
Yes. next (npm): upgrade to 15.5.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64643 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-64643?
Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • next (npm): upgrade to 15.5.21 or later
    npm install next@15.5.21

Technical details

A vulnerability in Next.js (CWE-201) allows for the disclosure of internal Server Function and Server Action endpoints. Unauthenticated users can discover Server Action IDs by inspecting publicly served client artifacts, such as static JavaScript chunks containing action references. This disclosure allows an attacker to bypass authentication checks that are typically enforced on the pages where these endpoints are used. While primarily a reconnaissance primitive, it enables unauthorized interaction with server-side logic. The issue is resolved in versions 15.5.21 and 16.2.11 by validating server reference IDs during manifest lookups.

Affected products

  • Vercel Next.js >= 12.0.0, < 15.5.21; >= 16.0.0, < 16.2.11

Identifiers

  • CVE-2026-64643
  • GHSA-955p-x3mx-jcvp

Timeline

  • 2026-07-21: patched: Fixed in versions 15.5.21 and 16.2.11
  • 2026-07-27: advisory: NVD and GitHub advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.