CVE-2026-64649: Vercel Next.js SSRF in Server Actions on custom servers

CVE-2026-64649 · Severity: high · CVSS 4 · Published 2026-07-27

Next.js is a popular framework used to build and host web applications. A vulnerability in its 'Server Actions' feature allows attackers to trick the server into making unauthorized requests to malicious external websites. This could lead to the exposure of sensitive internal data or bypass security checks that protect the application's backend.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is CVE-2026-64649 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-64649 being exploited in the wild.
How severe is CVE-2026-64649?
High severity, with a CVSS score of 4, published 27 July 2026.
Which products and versions are affected?
next (npm) SEMVER:introduced=14.1.1,fixed=15.5.21; Vercel Next.js >= 14.1.1, < 15.5.21; >= 16.0.0, < 16.2.11, 14.1.1 - 15.5.20, 16.0.0 - 16.2.10.
Is there a fix for CVE-2026-64649?
Yes. next (npm): upgrade to 15.5.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64649 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-64649?
Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • next (npm): upgrade to 15.5.21 or later
    npm install next@15.5.21

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Next.js Server Actions when a request is forwarded or redirected. The flaw occurs because the application may use attacker-controlled Host or X-Forwarded-Host headers to determine the destination of outbound requests. This is primarily exploitable on custom server deployments or environments where the host header is not pinned by an upstream proxy. Attackers can leverage this to force the server to connect to malicious endpoints or leak internal values that weaken middleware and proxy authorization. The issue is fixed in versions 15.5.21 and 16.2.11.

Affected products

  • Vercel Next.js 14.1.1 - 15.5.20, 16.0.0 - 16.2.10

Identifiers

  • CVE-2026-64649
  • GHSA-89xv-2m56-2m9x

Timeline

  • 2026-07-21: advisory: GitHub Security Advisory published
  • 2026-07-21: patched: Versions 15.5.21 and 16.2.11 released
  • 2026-07-27: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.