Next.js: Nine SSRF, Auth Bypass, and DoS Vulnerabilities Patched Together
Vercel patched nine critical and important security flaws in Next.js, including SSRF, authentication bypass, and DoS vulnerabilities, disclosed on July 27, 2026.
Key findings
- Vercel patched nine Next.js vulnerabilities on July 27, 2026, including SSRF, auth bypass, and DoS flaws.
- Server Actions are implicated in multiple SSRF and DoS vulnerabilities, with CVSSv3 scores up to 8.2.
- Information disclosure vulnerabilities affect server-side caching mechanisms and Server Action IDs.
- CVE-2026-64642, an authentication bypass flaw, was noted in broader cybersecurity news.
- All issues are fixed in Next.js versions 15.5.21 and 16.2.11.
On July 27, 2026, Vercel released patches for nine security vulnerabilities discovered in its popular Next.js framework. The vulnerabilities, disclosed together within a two-hour window, span several critical and important severity ratings, including Server-Side Request Forgery (SSRF), authentication bypass, denial of service (DoS), and information disclosure. These issues could allow attackers to gain unauthorized access, expose sensitive data, or disrupt service availability.
Several of the vulnerabilities are related to Next.js's Server Actions feature. CVE-2026-64649 and CVE-2026-64645, both rated as important with a CVSSv3 score of 8.2, involve Server-Side Request Forgery (SSRF) through malicious host redirection and the rewrites feature, respectively. Additionally, CVE-2026-64646 and CVE-2026-64644, both rated important with a CVSSv3 score of 7.5, allow for Denial of Service (DoS) attacks via excessive memory consumption in Server Actions and malicious image optimization, respectively. CVE-2026-6461, also an important DoS vulnerability (CVSSv3 7.5), targets the App Router with Server Actions.
Information disclosure is another significant theme within this batch. CVE-2026-64648 (important, CVSSv3 7.5) and CVE-2026-64647 (low, CVSSv3 3.7) relate to information disclosure via server-side fetch cache and server-side request caching, respectively. Furthermore, CVE-2026-64643 (moderate, CVSSv3 5.3) addresses information disclosure via Server Action ID exposure.
A critical authentication bypass vulnerability, CVE-2026-64642 (important, CVSSv3 8.2), could lead to unauthorized access. This particular vulnerability was mentioned in a broader cybersecurity newsletter, indicating potential interest from threat actors in exploiting such weaknesses.
All nine vulnerabilities have been fixed in Next.js versions 15.5.21 and 16.2.11. Users are strongly advised to update to these patched versions to mitigate the risks associated with SSRF, authentication bypass, DoS, and information disclosure attacks. This coordinated disclosure highlights the importance of timely patching for complex web frameworks like Next.js, as multiple attack vectors were addressed simultaneously. Vercel's commitment to a monthly security release program, as announced earlier, is crucial for maintaining the security posture of applications built with Next.js.