CVE-2026-64643

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10

Description Applications using App Router, Server Actions (use server), or use cache endpoints may disclose these endpoints, bypassing authentication on the pages where they are typically used. Server Action IDs can be exposed to unauthenticated users through publicly served client artifacts, such as static chunks containing action references. This issue primarily serves as a reconnaissance or enumeration primitive, which may increase risk when combined with other weaknesses.

Recommendations Update to version 15.5.21 or 16.2.11. Always authenticate within the use cache or use server boundary rather than assuming authentication claims at the boundary.