High
Next.js: Server-Side Request Forgery in Server Actions on Custom Servers
Type: advisorySources: OSV
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-64649
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 17:18 UTC · Revision 1
Source evidence
Next.js: Server-Side Request Forgery in Server Actions on Custom Servers
core-osv · Original sourcePublished 27 Jul 2026, 19:27 UTC
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11.
osv:CVE-2026-64649
Complete source record
{
"id": "7911c15cde0a5f487db43fa3e841c687c9d410981876fc5769f5ba4c5e937226",
"url": "https://osv.dev/vulnerability/CVE-2026-64649",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Next.js: Server-Side Request Forgery in Server Actions on Custom Servers",
"summary": "Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11.",
"evidence": "osv:CVE-2026-64649",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-64649",
"aliases": [
"CVE-2026-64649",
"GHSA-89xv-2m56-2m9x"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/vercel/next.js",
"type": "GIT",
"events": [
{
"introduced": "5f59ee5f197a09275da7a9fa876986f22f4b7711"
},
{
"fixed": "e26f6ffaa710fc62ca0c8640db0e43b6663edf32"
},
{
"introduced": "950609f96f694c5475d18cd2d72a0052ca04d4b9"
},
{
"fixed": "9beca0821cf4606ae33466ed6f4fc75f2887a4da"
},
{
"fixed": "b51206321854193208c0805ba42acc49287f942b"
},
{
"fixed": "e3e5666ccead3a15162793d697af5e48b7cc0498"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "14.1.1"
},
{
"fixed": "15.5.21"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.0.0"
},
{
"fixed": "16.2.11"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "b51206321854193208c0805ba42acc49287f942b"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "e3e5666ccead3a15162793d697af5e48b7cc0498"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "e26f6ffaa710fc62ca0c8640db0e43b6663edf32"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v15.5.21"
},
{
"range": [
{
"fixed": "9beca0821cf4606ae33466ed6f4fc75f2887a4da"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v16.2.11"
}
]
}
}
],
"versions": [
"v16.2.10",
"v16.2.9",
"v16.2.8",
"v16.2.6",
"v16.2.5",
"v16.2.4",
"v16.2.3",
"v16.2.2",
"v16.2.1",
"v16.2.0",
"v16.2.0-canary.104",
"v16.2.0-canary.103",
"v16.2.0-canary.102",
"v16.2.0-canary.101",
"v16.2.0-canary.100",
"v16.2.0-canary.99",
"v16.2.0-canary.98",
"v16.2.0-canary.97",
"v16.2.0-canary.96",
"v16.2.0-canary.95",
"v16.2.0-canary.94",
"v16.2.0-canary.93",
"v16.2.0-canary.92",
"v16.2.0-canary.91",
"v16.2.0-canary.90",
"v16.2.0-canary.89",
"v16.2.0-canary.88",
"v16.2.0-canary.87",
"v16.2.0-canary.86",
"v16.2.0-canary.85",
"v16.2.0-canary.84",
"v16.2.0-canary.83",
"v16.2.0-canary.82",
"v16.2.0-canary.81",
"v16.2.0-canary.78",
"v16.2.0-canary.80",
"v16.2.0-canary.79",
"v16.2.0-canary.77",
"v16.2.0-canary.76",
"v16.2.0-canary.75",
"v16.2.0-canary.74",
"v16.2.0-canary.71",
"v16.2.0-canary.73",
"v16.2.0-canary.69",
"v16.2.0-canary.72",
"v16.2.0-canary.70",
"v16.2.0-canary.68",
"v16.2.0-canary.67",
"v16.2.0-canary.66",
"v16.2.0-canary.65",
"v16.2.0-canary.64",
"v16.2.0-canary.63",
"v16.2.0-canary.62",
"v16.2.0-canary.61",
"v16.2.0-canary.60",
"v16.2.0-canary.59",
"v16.2.0-canary.58",
"v16.2.0-canary.57",
"v16.2.0-canary.56",
"v16.2.0-canary.55",
"v16.2.0-canary.54",
"v16.2.0-canary.53",
"v16.2.0-canary.52",
"v16.2.0-canary.51",
"v16.2.0-canary.50",
"v16.2.0-canary.49",
"v16.2.0-canary.48",
"v16.2.0-canary.47",
"v16.2.0-canary.46",
"v16.2.0-canary.45",
"v16.2.0-canary.44",
"v16.2.0-canary.43",
"v16.2.0-canary.42",
"v16.2.0-canary.41",
"v16.2.0-canary.40",
"v16.2.0-canary.39",
"v16.2.0-canary.38",
"v16.2.0-canary.37",
"v16.2.0-canary.36",
"v16.2.0-canary.35",
"v16.2.0-canary.34",
"v16.2.0-canary.33",
"v16.2.0-canary.32",
"v16.2.0-canary.31",
"v16.2.0-canary.30",
"v16.2.0-canary.29",
"v16.2.0-canary.28",
"v16.2.0-canary.27",
"v16.2.0-canary.26",
"v16.2.0-canary.25",
"v16.2.0-canary.24",
"v16.2.0-canary.23",
"v16.2.0-canary.22",
"v16.2.0-canary.21",
"v16.2.0-canary.20",
"v16.2.0-canary.19",
"v16.2.0-canary.18",
"v16.2.0-canary.17",
"v16.2.0-canary.16",
"v16.2.0-canary.15",
"v16.2.0-canary.14",
"v16.2.0-canary.11",
"v16.2.0-canary.13",
"v16.2.0-canary.12",
"v16.2.0-canary.10",
"v16.2.0-canary.9",
"v16.2.0-canary.8",
"v16.2.0-canary.7",
"v16.2.0-canary.6",
"v16.2.0-canary.5",
"v16.2.0-canary.4",
"v16.2.0-canary.3",
"v16.2.0-canary.2",
"v16.2.0-canary.1",
"v16.2.0-canary.0",
"v16.1.1-canary.36",
"v16.1.1-canary.35",
"v16.1.1-canary.34",
"v16.1.1-canary.33",
"v16.1.1-canary.32",
"v16.1.1-canary.30",
"v16.1.1-canary.31",
"v16.1.1-canary.29",
"v16.1.1-canary.28",
"v16.1.1-canary.27",
"v16.1.1-canary.26",
"v16.1.1-canary.25",
"v16.1.1-canary.24",
"v16.1.1-canary.23",
"v16.1.1-canary.22",
"v16.1.1-canary.21",
"v16.1.1-canary.20",
"v16.1.1-canary.19",
"v16.1.1-canary.18",
"v16.1.1-canary.17",
"v16.1.1-canary.16",
"v16.1.1-canary.15",
"v16.1.1-canary.14",
"v16.1.1-canary.13",
"v16.1.1-canary.12",
"v16.1.1-canary.11",
"v16.1.1-canary.10",
"v16.1.1-canary.9",
"v16.1.1-canary.8",
"v16.1.1-canary.7",
"v16.1.1-canary.6",
"v16.1.1-canary.5",
"v16.1.1-canary.4",
"v16.1.0",
"v16.1.1-canary.3",
"v16.1.1-canary.2",
"v16.1.1-canary.1",
"v16.1.1-canary.0",
"v16.1.0-canary.34",
"v16.1.0-canary.33",
"v16.1.0-canary.32",
"v16.1.0-canary.31",
"v16.1.0-canary.30",
"v16.1.0-canary.29",
"v16.1.0-canary.28",
"v16.1.0-canary.27",
"v16.1.0-canary.26",
"v16.1.0-canary.25",
"v16.1.0-canary.24",
"v16.1.0-canary.23",
"v16.1.0-canary.22",
"v16.1.0-canary.21",
"v16.1.0-canary.20",
"v16.1.0-canary.19",
"v16.1.0-canary.18",
"v16.1.0-canary.17",
"v16.1.0-canary.16",
"v16.1.0-canary.15",
"v16.1.0-canary.14",
"v16.1.0-canary.13",
"v16.1.0-canary.11",
"v16.1.0-canary.12",
"v16.1.0-canary.10",
"v16.1.0-canary.9",
"v16.1.0-canary.8",
"v16.1.0-canary.7",
"v16.1.0-canary.4",
"v16.1.0-canary.6",
"v16.1.0-canary.5",
"v16.1.0-canary.3",
"v16.1.0-canary.2",
"v16.1.0-canary.1",
"v16.1.0-canary.0",
"v16.0.2-canary.34",
"v16.0.2-canary.33",
"v16.0.2-canary.32",
"v16.0.2-canary.31",
"v16.0.2-canary.30",
"v16.0.2-canary.29",
"v16.0.2-canary.28",
"v16.0.2-canary.27",
"v16.0.2-canary.26",
"v16.0.2-canary.25",
"v16.0.2-canary.24",
"v16.0.2-canary.23",
"v16.0.2-canary.22",
"v16.0.2-canary.21",
"v16.0.2-canary.20",
"v16.0.2-canary.19",
"v16.0.2-canary.18",
"v16.0.2-canary.17",
"v16.0.2-canary.16",
"v16.0.1",
"v16.0.2-canary.15",
"v16.0.2-canary.14",
"v16.0.2-canary.13",
"v16.0.2-canary.12",
"v16.0.2-canary.11",
"v16.0.2-canary.10",
"v16.0.2-canary.9",
"v16.0.2-canary.8",
"v16.0.2-canary.7",
"v16.0.2-canary.6",
"v16.0.2-canary.5",
"v16.0.2-canary.4",
"v16.0.2-canary.3",
"v16.0.2-canary.2",
"v16.0.2-canary.1",
"v16.0.2-canary.0",
"v16.0.1-canary.6",
"v16.0.1-canary.5",
"v16.0.1-canary.4",
"v16.0.1-canary.3",
"v16.0.1-canary.2",
"v16.0.1-canary.1",
"v16.0.1-canary.0",
"v16.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64649.json"
}
}
],
"modified": "2026-10-28T02:30:44.523733548Z",
"provider": "osv",
"references": [
"https://github.com/vercel/next.js/releases/tag/v15.5.21",
"https://github.com/vercel/next.js/releases/tag/v16.2.11",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64649.json",
"https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x",
"https://nvd.nist.gov/vuln/detail/CVE-2026-64649",
"https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b",
"https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"
],
"provider_metadata": {
"cwe_ids": [
"CWE-918"
],
"cna_assigner": "GitHub_M",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": ">= 16.0.0 < 16.2.11"
},
{
"last_affected": ">= 16.0.0 < 16.2.11"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64649.json"
}
},
"related_cves": [
{
"value": "CVE-2026-64649",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 512513,
"published_at": "2026-07-27T19:27:58.865+00:00"
}