Next.js Releases Critical Security Patches Addressing Multiple High Severity Vulnerabilities Across App Router and Server Actions

Vercel, the primary maintainer of the Next.js framework, has officially released a comprehensive suite of security updates designed to remediate several high-severity vulnerabilities that could lead to Denial of Service (DoS), Server-Side Request Forgery (SSRF), and middleware bypasses. The updates, which arrive as part of a newly implemented preannounced security release model, target several versions of the React-based framework, specifically addressing flaws found within the App Router architecture, Server Actions, and the Image Optimization API. Developers are urged to update their dependencies immediately to v16.2.11 for those on Active Long-Term Support (LTS) or v15.5.21 for those on Maintenance LTS. These fixes have also been integrated into the latest canary and preview builds of the upcoming v16.3.0 release.

This coordinated release follows a strategic shift in how Vercel manages framework security. By moving to a preannounced model, the company aims to provide enterprise dev-ops teams and independent developers with a window of preparation, allowing them to schedule maintenance cycles before the technical details of the vulnerabilities are made public. This approach mirrors the security practices of other major infrastructure providers and underscores the critical role Next.js plays in the modern web ecosystem, where it powers millions of production applications ranging from individual blogs to Fortune 500 e-commerce platforms.

Overview of High-Severity Vulnerabilities

The most pressing issues addressed in this patch cycle involve the Next.js App Router, a foundational component introduced to handle complex routing and server-side logic. Among these, CVE-2026-64641 stands out as a high-severity threat involving a Denial of Service vulnerability. According to the technical advisory, an attacker can send specifically crafted requests to applications that utilize the App Router and have at least one Server Action enabled. These requests trigger excessive CPU usage, which effectively blocks the processing of subsequent requests within the same process. Because Node.js operates on a single-threaded event loop for JavaScript execution, such CPU exhaustion can bring an entire application instance to a standstill, necessitating a restart or resulting in significant latency for legitimate users.

Equally concerning is CVE-2026-64642, which affects applications built with Turbopack—Next.js’s high-performance incremental bundler written in Rust. In scenarios where an application uses a single locale entry within the config.i18n.locales setting, a flaw allows attackers to bypass middleware and proxy security checks. Middleware is frequently used in Next.js applications to enforce authentication, validate session tokens, or implement geographic restrictions. A bypass of this layer means that protected routes could potentially be accessed without proper authorization, exposing sensitive data or administrative functions to unauthorized actors.

The release also mitigates two distinct high-severity Server-Side Request Forgery (SSRF) vulnerabilities. CVE-2026-64645 involves the rewrites() and redirects() functions. If an application builds an external destination hostname based on input controlled by the requester, an attacker can manipulate that input to point the request toward an arbitrary, malicious hostname. In the context of a rewrite, this facilitates SSRF, allowing the attacker to use the server as a proxy to attack internal infrastructure. In the context of a redirect, it enables "Open Redirect" attacks, which are frequently used in phishing campaigns to lend a false sense of legitimacy to malicious URLs.

The second SSRF flaw, identified as CVE-2026-64649, specifically targets Server Actions running on custom servers. This vulnerability occurs when a Server Action forwards or redirects a request, and the attacker is able to control Host-associated headers. By manipulating these headers, an attacker can force the server to initiate outbound requests to a destination of their choosing. This is particularly dangerous in cloud environments where SSRF can be used to query internal metadata services (such as the AWS Instance Metadata Service) to exfiltrate temporary security credentials.

Medium-Severity Risks and Cache Confusion

Beyond the high-severity patches, the update addresses several medium-severity issues that could impact application performance and data integrity. CVE-2026-64644 concerns the Image Optimization API, a popular feature that automatically resizes and optimizes images to improve Core Web Vitals. When self-hosting Next.js with the default image loader, the API can be configured to optimize remotely hosted images. If these remote images contain malicious SVG content or other crafted data, they can cause CPU exhaustion at the /_next/image endpoint, leading to localized Denial of Service.

In the Edge Runtime environment, CVE-2026-64646 addresses a memory consumption issue related to unbounded Server Action payloads. Crafted requests can lead to excessive memory usage, potentially triggering Out-of-Memory (OOM) errors that crash the Edge function or serverless instance. This vulnerability highlights the ongoing challenge of managing resource limits in highly distributed, ephemeral execution environments.

Furthermore, the release fixes two "Cache Confusion" vulnerabilities: CVE-2026-64648 and CVE-2026-64647. These issues occur when the server-side fetch implementation incorrectly handles request bodies during the caching process. In certain configurations, a fetch call might return a cached response body from a previous request even if the current request has a different body, provided they share the same URL. CVE-2026-64647 specifically notes that this can be triggered by request bodies containing invalid UTF-8 byte sequences. For instance, different UTF-16 sequences might be treated as identical cache keys, leading to the wrong data being served to the user. This poses a risk to data privacy and functional correctness, especially in applications that rely heavily on server-side data fetching for personalized content.

Finally, CVE-2026-64643 addresses the unauthenticated disclosure of internal Server Function endpoints. In applications using the App Router, the unique IDs for Server Actions and "use cache" endpoints could be globally disclosed. While not directly allowing for unauthorized execution in all cases, this disclosure provides valuable reconnaissance data for attackers, allowing them to map out the internal logic of an application as a precursor to more complex multi-stage attacks.

Chronology of the Security Response

The path to this release began several months ago as part of a broader initiative by Vercel to fortify the security posture of the Next.js ecosystem. The timeline of events reflects a disciplined approach to vulnerability management:

1. Vulnerability Discovery: Various independent security researchers identified the flaws through Vercel’s Open Source Bug Bounty program hosted on HackerOne. This program incentivizes the ethical disclosure of bugs in Next.js and other Vercel-maintained frameworks.
2. Internal Validation: Vercel’s security team validated the findings and assessed the potential impact on different deployment environments, including Vercel’s own platform and self-hosted instances.
3. Policy Shift (Last Week): Vercel announced the transition to a preannounced security release model. This was a response to community feedback requesting more predictability regarding security patches.
4. Pre-Notification: Major partners and large-scale enterprise users were given advanced notice of the impending patch window to ensure they could prepare their deployment pipelines.
5. Official Patch Release: On the scheduled date, Vercel pushed the updates to the npm registry and published the corresponding CVE advisories.
6. LTS Integration: The fixes were backported to the Active and Maintenance LTS branches to ensure that teams on older, stable versions of Next.js remained protected without needing to perform a major version upgrade.

Industry Impact and Supporting Data

Next.js has become the dominant framework for React-based development, with millions of weekly downloads on npm. According to the 2023 State of JS survey, Next.js maintains one of the highest retention and usage rates among all front-end frameworks. Because it is used by major corporations—including Netflix, TikTok, and Twitch—a vulnerability in the core framework has a massive blast radius.

The vulnerabilities addressed in this cycle are particularly significant because they target the "App Router" and "Server Actions," which represent the future direction of the framework. Server Actions, in particular, simplify the bridge between client-side interactions and server-side logic, but as this patch cycle demonstrates, they also introduce new attack vectors if not strictly bounded and validated.

Security experts note that SSRF remains one of the top risks for modern web applications. According to the OWASP Top 10, SSRF has gained prominence as more applications move to cloud-native architectures where internal services are often protected only by network-level trust rather than robust authentication. By patching these SSRF flaws, Vercel is preventing potential lateral movement within corporate networks.

Official Responses and Recommendations

In an official statement, Vercel emphasized its commitment to the security of the open-source community. "We work with a talented set of researchers to secure Next.js and other open-source frameworks through Vercel’s Open Source Bug Bounty," the company stated. "Anyone interested in contributing to the security of eligible frameworks is encouraged to participate."

Vercel has also opened a direct line of communication for security concerns, inviting developers to reach out to their dedicated security team for any questions regarding vulnerability management. The company maintains that while no software is entirely free of flaws, the speed of response and the transparency of the disclosure process are the most effective tools in maintaining user trust.

For developers and organizations using Next.js, the following actions are recommended:

• Update Immediately: Execute npm install next@latest or the equivalent command for your package manager to pull in the latest security fixes.
• Audit Middleware: Review middleware configurations, especially if using Turbopack, to ensure that authentication checks are robust and not solely reliant on path-based matching that might be bypassed.
• Validate Inputs: Ensure that any user-controlled input used in rewrites or redirects is strictly sanitized and validated against a whitelist of allowed hostnames.
• Monitor CPU Usage: Applications that cannot update immediately should monitor their server metrics for unusual spikes in CPU usage, which could indicate an active DoS attempt targeting Server Actions.

Broader Implications for the Web Ecosystem

The release of these patches highlights a growing trend in the JavaScript ecosystem: the professionalization of open-source security. As frameworks like Next.js become the "operating systems" of the web, the responsibility of their maintainers shifts from merely providing features to ensuring the safety of the global digital infrastructure.

The move to a preannounced security model is a significant step toward maturity. It acknowledges that for large organizations, "zero-day" patches—even when they are fixes—can be disruptive. By providing a predictable cadence, Vercel is helping to bridge the gap between the fast-moving world of open-source development and the stability-focused world of enterprise IT.

Furthermore, the focus on "Cache Confusion" and "Edge Runtime" vulnerabilities reflects the shifting landscape of web performance. As more logic moves to the "Edge" (geographically distributed serverless functions), the complexity of maintaining state and ensuring data isolation increases. These patches serve as a reminder that performance-enhancing features like caching and edge execution require rigorous security auditing to prevent data leaks and service disruptions.

As Next.js continues to evolve toward its v16.3 stable release, the lessons learned from this security cycle will likely inform the development of more "secure by default" features. For now, the priority remains clear: the global community of Next.js developers must act swiftly to apply these updates and shield their applications from the high-severity risks identified in this latest security advisory.