CVE-2026-64649: Next.js: Server-Side Request Forgery in Server Actions on custom servers
When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker’s request to control Host-associated headers. In some configurations, it’s also possible to obtain internal values that weaken middleware/proxy authorization.
Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward.
References
- github.com/advisories/GHSA-89xv-2m56-2m9x
- github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b
- github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498
- github.com/vercel/next.js/releases/tag/v15.5.21
- github.com/vercel/next.js/releases/tag/v16.2.11
- github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x
- nvd.nist.gov/vuln/detail/CVE-2026-64649
Code Behaviors & Features
Detect and mitigate CVE-2026-64649 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →