Loading story…
Vercel has patched three high-severity vulnerabilities in Next.js that could allow server-side request forgery (SSRF) and, in a narrower configuration, bypass middleware-based authentication. The flaws are tracked as CVE-2026-64645, CVE-2026-64649, and CVE-2026-64642, each rated CVSS 8.3, and affect multiple supported branches of the framework. According to the advisory coverage, the SSRF issues can be triggered under specific configurations, while the authentication bypass affects deployments using the App Router and Turbopack in a limited scenario.
The issues were fixed in Next.js 16.2.11 and 15.5.21, with no public proof-of-concept or confirmed in-the-wild exploitation reported at publication time. Defenders are advised to upgrade promptly, avoid user-controlled external destination hostnames, validate Host and X-Forwarded-Host headers, and enforce authorization checks in server-side page logic rather than relying solely on middleware protections.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Vercel fixed three high-severity Next.js flaws: CVE-2026-64645 and CVE-2026-64649, which can enable SSRF in specific configurations, and CVE-2026-64642, which can allow middleware-based authentication bypass in a narrower App Router and Turbopack scenario. The fixes were released in Next.js versions 16.2.11 and 15.5.21.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Vercel issued a coordinated Next.js security release covering 13 advisories, including a high-severity server-side request forgery flaw tracked as **CVE-2026-44578** / `GHSA-c4j6-fc7j-m34r`. The bug affects self-hosted applications using the built-in Node.js server, where crafted WebSocket upgrade requests can be abused to proxy traffic to arbitrary internal or external destinations. That exposure can let attackers reach cloud metadata endpoints, internal admin interfaces, and other internal services, potentially stealing cloud credentials, API keys, and deployment secrets. Vercel-hosted deployments were reported as unaffected because they do not use the vulnerable WebSocket routing path. The release also fixed an App Router authorization bypass, `GHSA-267c-6grr-h53f`, in which specially crafted `.rsc` and segment-prefetch URLs could evade middleware or proxy-based access controls and expose protected content. A public GitHub repository has since collected proof-of-concept material for 12 issues fixed in `next` 16.2.5, including SSRF, middleware bypass, cache poisoning, XSS, and denial-of-service bugs, increasing the urgency for defenders to patch. Vercel said patching is the only complete mitigation and advised upgrading to **Next.js** `15.5.18` or `16.2.6`, with immediate interim steps including blocking unnecessary WebSocket upgrades, restricting origin-server egress to metadata and internal networks, and enforcing authorization checks in route or page logic rather than relying solely on middleware.
Jun 29, 2026
Vercel has released a broad set of security fixes for **Next.js** and related **React Server Components**, addressing more than a dozen vulnerabilities affecting App Router deployments across versions 13.x through 16.x and React Server Components 19.x. The disclosures include denial of service, server-side request forgery, cross-site scripting, cache poisoning, and multiple middleware authorization bypass conditions. Among the most serious issues is `CVE-2026-23870` (`GHSA-8h8q-6873-q5fj`), a high-severity denial-of-service flaw in React Flight deserialization that can be triggered through crafted requests to App Router Server Function endpoints, causing excessive CPU consumption; fixes were issued in Next.js `15.5.16` and `16.2.5`. Vercel also disclosed `CVE-2026-44578`, a high-severity SSRF issue in self-hosted Node.js deployments via crafted WebSocket upgrade requests.
Jun 29, 2026
A critical vulnerability in **Next.js** tracked as `CVE-2025-29927` allows attackers to bypass authorization controls when applications rely on **Middleware** for access checks under specific deployment conditions. Researchers showed that specially crafted requests using the `x-middleware-subrequest` header can cause Middleware processing to be skipped, forwarding requests directly to protected endpoints. The issue was described as an authorization bypass with a **CVSS 9.1** severity rating and was later detailed by the Next.js team in a postmortem. The flaw affects multiple Next.js release lines, with fixes released in **15.2.3**, **14.2.25**, **13.5.9**, and **12.3.5**. Guidance from defenders and the vendor says organizations should patch immediately, and those unable to update should block external requests containing the `x-middleware-subrequest` header. The exposure is tied to applications run with `next start` using the `output: 'standalone'` setting, while hosted Next.js deployments on **Vercel** and **Netlify** were reported as protected from this issue.
Jul 24, 2026