Executive brief
Next.js is a popular framework used to build web applications. A vulnerability exists where internal identifiers for server-side functions can be leaked to unauthenticated users through public website files. While this does not directly grant access to private data, it allows attackers to discover and potentially interact with internal endpoints that were intended to be protected by authentication, increasing the risk of further attacks.
Technical details
A vulnerability in Next.js (CWE-201) allows for the disclosure of internal Server Function and Server Action endpoints. Unauthenticated users can discover Server Action IDs by inspecting publicly served client artifacts, such as static JavaScript chunks containing action references. This disclosure allows an attacker to bypass authentication checks that are typically enforced on the pages where these endpoints are used. While primarily a reconnaissance primitive, it enables unauthorized interaction with server-side logic. The issue is resolved in versions 15.5.21 and 16.2.11 by validating server reference IDs during manifest lookups.
Affected products
- Vercel Next.js >= 12.0.0, < 15.5.21; >= 16.0.0, < 16.2.11
Timeline
- 2026-07-21: patched: Fixed in versions 15.5.21 and 16.2.11
- 2026-07-27: advisory: NVD and GitHub advisory published
References
- https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3
- https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b
- https://github.com/vercel/next.js/releases/tag/v15.5.21
- https://github.com/vercel/next.js/releases/tag/v16.2.11
- https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp