CVE-2026-64649

Name of the Vulnerable Software and Affected Versions Next.js versions 14.1.1 through 15.5.20 Next.js versions 16.0.0 through 16.2.10

Description When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host, leading to Server-Side Request Forgery (SSRF), which is a technique where an attacker induces a server-side application to make requests to an unintended location. This occurs when the attacker controls Host-associated headers and the incoming host header is not fixed to a trusted value, a scenario common in custom servers or deployments without a proxy that pins the host. In certain configurations, this can also be used to obtain internal values that weaken middleware or proxy authorization.

Recommendations Update Next.js versions 14.1.1 through 15.5.20 to version 15.5.21. Update Next.js versions 16.0.0 through 16.2.10 to version 16.2.11. Pin or validate Host and X-Forwarded-Host headers at the edge or proxy level to prevent clients from controlling the host header. For versions 14.2.0 and later, set the NEXT PRIVATE ORIGIN environment variable to the actual origin of the deployment.