Introduction: Why Next.js Security Flaws Matter
Vercel has released important security updates addressing Next.js Security Flaws, fixing nine vulnerabilities that could allow attackers to perform Server-Side Request Forgery (SSRF), bypass authentication, trigger Denial-of-Service (DoS) attacks, expose sensitive information, and cause cache-related issues. The vulnerabilities were responsibly disclosed by security researcher KarimPwnz and affect multiple components of the widely used React framework.
The fixes for the Next.js Security Flaws are available in Next.js versions 15.5.21 and 16.2.11, while older 13.x and 14.x releases will not receive security updates. Organizations using unsupported versions are strongly encouraged to upgrade immediately to reduce their exposure to these vulnerabilities.
What is Next.js?
Next.js is an open-source React framework developed by Vercel that enables developers to build modern web applications with features such as server-side rendering, static site generation, API routes, middleware, and server actions. It is widely adopted by startups and enterprises because of its performance, scalability, and developer-friendly architecture.
Due to its popularity, security vulnerabilities in Next.js can affect thousands of production applications worldwide, making timely patching essential.
What Caused the Vulnerabilities?
According to the published security advisories, the vulnerabilities stem from weaknesses in several framework components, including:
- Dynamic rewrites() and redirects() handling
- Server Actions
- Middleware authentication logic
- Cache Components
- Image Optimization API
- Custom Node.js server configurations
Several of these issues become exploitable when applications use user-controlled input without proper validation, allowing attackers to manipulate requests or consume excessive server resources.
Next.js Security Flaws: Full Technical Breakdown
The latest security release fixes nine vulnerabilities across multiple components of the framework.
Timeline of Events
- Security researcher KarimPwnz privately disclosed the vulnerabilities.
- Vercel investigated and validated the reported issues.
- Security advisories were published alongside patched releases.
- Fixes became available in Next.js 15.5.21 and 16.2.11.
- Users running legacy 13.x and 14.x versions were advised to migrate because those releases will no longer receive security patches.
Major Vulnerabilities Addressed
1. CVE-2026-64645 (High) – SSRF via Rewrites and Redirects
The most severe vulnerability enables Server-Side Request Forgery (SSRF) when destination hostnames are generated from user-controlled input through the framework’s rewrites() or redirects() features.
A successful exploit could redirect server requests to unintended internal or external systems, potentially exposing sensitive network resources.
2. CVE-2026-64649 (High) – SSRF in Server Actions
Another high-severity flaw affects Server Actions running on custom Node.js servers.
Attackers may manipulate outbound requests, causing servers to communicate with attacker-controlled destinations instead of legitimate endpoints.
3. CVE-2026-64642 – Authentication Bypass
This vulnerability impacts applications using specific App Router configurations together with Turbopack and legacy middleware.
Under certain conditions, attackers could bypass middleware-based authentication checks and access protected application routes.
4. CVE-2026-64641 – Denial-of-Service
A separate flaw allows specially crafted Server Actions requests to consume excessive resources, potentially resulting in a Denial-of-Service (DoS) condition that disrupts application availability.
Additional Moderate-Severity Issues
Vercel also fixed five moderate vulnerabilities involving:
- Memory exhaustion
- Image Optimization API crashes
- Cache confusion bugs
- Server Function endpoint identifier disclosure
- Additional stability and information exposure issues
Potential Risks & Impact
Identity and Security Risks
Applications vulnerable to SSRF may unintentionally expose internal infrastructure, cloud metadata services, or private network resources. Authentication bypass vulnerabilities may also allow unauthorized access to restricted application features depending on deployment configuration.
Business Impact
Organizations affected by the Next.js Security Flaws could experience:
- Service outages caused by DoS attacks
- Exposure of sensitive application information
- Increased operational downtime
- Higher incident response costs
- Loss of customer trust if production services become unavailable
Official Response
Vercel has addressed the Next.js Security Flaws in Next.js 15.5.21 and 16.2.11 and recommends that users upgrade immediately. Since versions 13.x and 14.x have reached the end of security support, no patches will be released for those branches.
Developers should also review configurations involving rewrites, redirects, custom Node.js servers, Server Actions, Turbopack middleware, and Cache Components to ensure secure deployments.
Industry Context: Why Framework Vulnerabilities Are Increasing
Modern web frameworks continue to evolve rapidly by introducing features such as server-side rendering, middleware execution, server actions, and intelligent caching. While these capabilities improve performance and developer productivity, they also expand the application’s attack surface.
Organizations should regularly monitor security advisories and promptly apply framework updates to reduce risk. Readers interested in similar incidents can explore CyberNexora’s Cyber Incidents category.
Developers should also follow secure coding practices discussed in CyberNexora’s Learn & Protect section.
For official technical guidance, refer to the OWASP SSRF Prevention Cheat Sheet and the CWE database for secure application development practices.
How to Protect Your Organization
Organizations using Next.js should take immediate steps to reduce the risk posed by these vulnerabilities:
- Upgrade immediately to Next.js 15.5.21 or 16.2.11.
- Retire unsupported versions such as 13.x and 14.x, which will no longer receive security fixes.
- Validate all user-controlled inputs used in
rewrites()andredirects()to prevent SSRF attacks. - Review custom Node.js server configurations and restrict outbound requests where possible.
- Audit Server Actions and middleware to ensure authentication logic cannot be bypassed.
- Monitor application logs for unusual redirects, failed authentication attempts, or abnormal traffic that could indicate exploitation.
Developers can also find additional cybersecurity best practices in CyberNexora’s Resources section.
Key Takeaways
- Vercel has patched the Next.js Security Flaws affecting multiple framework components.
- The most severe flaws could enable SSRF, authentication bypass, and DoS attacks.
- Security updates are available in Next.js 15.5.21 and 16.2.11.
- Older 13.x and 14.x releases will not receive security patches.
- Organizations should upgrade immediately and review application configurations to minimize risk.
Conclusion: Next.js Security Flaws and What Happens Next
The disclosure of the Next.js Security Flaws highlights how vulnerabilities in widely adopted development frameworks can have far-reaching consequences for organizations worldwide. Because the Next.js Security Flaws affect a framework powering thousands of production applications, delaying updates could significantly increase the risk of exploitation.
Organizations should prioritize upgrading to the latest supported versions, review their deployment configurations, and continuously monitor security advisories for future updates. Staying proactive with framework maintenance remains one of the most effective ways to reduce cyber risk and maintain secure web applications.
Frequently Asked Questions(FAQs)
The Next.js Security Flaws refer to nine vulnerabilities patched by Vercel, including SSRF, authentication bypass, Denial-of-Service, cache confusion, and information disclosure issues. The fixes are available in Next.js versions 15.5.21 and 16.2.11.
Vercel has released security patches in Next.js 15.5.21 and 16.2.11. Older 13.x and 14.x branches will not receive security updates.
The highest-severity issue is CVE-2026-64645, which allows Server-Side Request Forgery (SSRF) through improperly configured rewrites() and redirects() when user-controlled input is used.
The vulnerabilities were responsibly disclosed by security researcher KarimPwnz, allowing Vercel to investigate and release patches before broader exploitation.
Organizations should immediately upgrade to supported Next.js versions, validate user input, audit Server Actions and middleware, secure custom Node.js servers, and continuously monitor application logs for suspicious activity.