CVE-2026-64649 – SSRF in Server Actions – Next.js 14.1.1–15.5.20 and 16.0.0–16.2.10

Summary

CVE-2026-64649 is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in Next.js Server Actions, rated 8.3 (High) under CVSS 4.0. When a Server Action forwards or redirects a request, an unauthenticated attacker who can control Host-associated headers can cause the server to send that outbound request to an attacker-controlled host. In some configurations, the vulnerability also leaks internal values that can weaken middleware and proxy-based authorization controls.

Technical details

• Root cause: Next.js Server Actions do not validate or enforce a trusted value for incoming Host-associated headers (e.g., Host, X-Forwarded-Host). When a Server Action triggers a forward or redirect, the destination is constructed using the attacker-supplied header value.
• Trigger conditions: The application must use Server Actions, and the incoming host header must not be fixed to a trusted value. This typically occurs on custom server deployments or on deployments not running behind a reverse proxy that pins the host header. Managed hosting environments and next start / standalone output from version 14.2 onward pin the host upstream and are not affected.
• Attack vector: Unauthenticated network attacker supplies a crafted Host or X-Forwarded-Host header to a vulnerable Next.js endpoint that invokes a Server Action performing a forward or redirect.
• Primary impact: SSRF — the server issues outbound HTTP requests to an attacker-controlled host, potentially enabling internal network reconnaissance, interaction with cloud metadata services, or exfiltration of server-side data.
• Secondary impact: In some configurations, internal values used for middleware and proxy authorization are exposed, creating a potential pathway to authorization bypass.

Affected software

• Next.js 14.1.1 through 15.5.20
• Next.js 16.0.0 through 16.2.10

Severity

CVSS 4.0 Base Score: 8.3 (High)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Mitigation and recommended actions

• Immediate – upgrade: Apply the vendor-released patches:
  • Next.js 15.5.21 (Maintenance LTS)
  • Next.js 16.2.11 (Active LTS)

  npm install [email protected]   # for 15.x
  npm install [email protected]   # for 16.x
  

• Workaround (if patching is not immediately feasible):
  • Set the __NEXT_PRIVATE_ORIGIN environment variable to your deployment’s actual origin to pin the host value used by Server Actions:

    __NEXT_PRIVATE_ORIGIN=https://www.example.com node server.js
    

  • Alternatively, configure your edge or reverse proxy layer to enforce and pin the Host and X-Forwarded-Host headers to a trusted value before requests reach the Next.js process.
• Deployments not at risk: Applications running on managed hosting platforms that pin the host header upstream, or using next start / standalone output on Next.js 14.2 or later, are not affected and do not require remediation for this specific issue.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-64649 at NIST
• Next.js July 2026 Security Release
• GitHub Advisory GHSA-89xv-2m56-2m9x