CVE-2026-64649: Next.js: Server-Side Request Forgery in Server Actions on custom servers
When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker’s request to control Host-associated headers. In some configurations, it’s also possible to obtain internal values that weaken middleware/proxy authorization.
Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward.
References
- github.com/advisories/GHSA-89xv-2m56-2m9x
- github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b
- github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498
- github.com/vercel/next.js/releases/tag/v15.5.21
- github.com/vercel/next.js/releases/tag/v16.2.11
- github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x
- nvd.nist.gov/vuln/detail/CVE-2026-64649
Code Behaviors & Features
Detect and mitigate CVE-2026-64649 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →