Packages / next / Security

HighVulnerabilityGHSA-89xv-2m56-2m9xCVE-2026-64649Published 22 Jul 2026

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Affected releases · next

  • 16.x16.0.0 – 16.2.10Fixed in 16.2.11
  • 15.x15.0.0 – 15.5.20Fixed in 15.5.21
  • 14.x14.1.1 – 14.2.35No fix on this line yet

On 16.x, the newest line:

npm install next@16.2.11
16.x

  1. Affected

    16.0.0 – 16.2.10

    31 releases

  2. Fixed

    16.2.11 – 16.4.2

    14 releases, latest

15.x

  1. Affected

    15.0.0 – 15.5.20

    74 releases

  2. Fixed

    15.5.21 – 15.5.28

    8 releases

14.x

  1. Not affected

    14.0.0 – 14.1.0

    6 releases

  2. Affected

    14.1.1 – 14.2.35

    40 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.

Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward.

Workarounds

If you cannot upgrade, ensure clients do not control the host header your application receives. Pin or validate Host and X-Forwarded-Host at your edge or proxy. On version 14.2.0 and later, you can additionally set the __NEXT_PRIVATE_ORIGIN environment variable to your deployment's real origin:

__NEXT_PRIVATE_ORIGIN=https://www.example.com node server.js