Packages / next / Security

ModerateVulnerabilityGHSA-mq59-m269-xvcxCVE-2026-27978Published 17 Mar 2026

Next.js: null origin can bypass Server Actions CSRF checks

Affected releases · next

  • 16.x16.0.1 – 16.1.6Fixed in 16.1.7

On 16.x, the newest line:

npm install next@16.1.7

  1. Not affected

    0.1.0 – 16.0.0

    379 releases

  2. Affected

    16.0.1 – 16.1.6

    18 releases

  3. Fixed

    16.1.7 – 16.4.2

    26 releases, latest

423 stable releases of next, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Summary

origin: null was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests.

Impact

An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF).

Patches

Fixed by treating 'null' as an explicit origin value and enforcing host/origin checks unless 'null' is explicitly allowlisted in experimental.serverActions.allowedOrigins.

Workarounds

If upgrade is not immediately possible:

  • Add CSRF tokens for sensitive Server Actions.

  • Prefer SameSite=Strict on sensitive auth cookies.

  • Do not allow 'null' in serverActions.allowedOrigins unless intentionally required and additionally protected.