Executive brief
Next.js is a popular framework used to build and host web applications. A vulnerability in its 'Server Actions' feature allows attackers to trick the server into making unauthorized requests to malicious external websites. This could lead to the exposure of sensitive internal data or bypass security checks that protect the application's backend.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Next.js Server Actions when a request is forwarded or redirected. The flaw occurs because the application may use attacker-controlled Host or X-Forwarded-Host headers to determine the destination of outbound requests. This is primarily exploitable on custom server deployments or environments where the host header is not pinned by an upstream proxy. Attackers can leverage this to force the server to connect to malicious endpoints or leak internal values that weaken middleware and proxy authorization. The issue is fixed in versions 15.5.21 and 16.2.11.
Affected products
- Vercel Next.js 14.1.1 - 15.5.20, 16.0.0 - 16.2.10
Timeline
- 2026-07-21: advisory: GitHub Security Advisory published
- 2026-07-21: patched: Versions 15.5.21 and 16.2.11 released
- 2026-07-27: disclosed: NVD publication date
References
- https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b
- https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498
- https://github.com/vercel/next.js/releases/tag/v15.5.21
- https://github.com/vercel/next.js/releases/tag/v16.2.11
- https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x