Blog / 01

Next.js July 2026: 9 CVEs, Patch to 16.2.11 / 15.5.21

WebRestart

On July 21, 2026 Vercel published a coordinated security release for Next.js covering nine advisories: four High and five Moderate. The patched versions are 16.2.11 and 15.5.21. If you run Next.js on your own infrastructure, three of the four High-severity issues affect you more than they affect anyone on managed hosting.

There are no back-patches for 13.x or 14.x. Those applications have to move to a supported minor before any of these fixes are available to them.

The four High-severity issues

Middleware bypass on Turbopack with a single locale

CVE-2026-64642 (CVSS 8.3) affects App Router applications built with Turbopack and configured with exactly one locale entry. Crafted requests skip middleware entirely, which means middleware- or proxy-based authentication is bypassed. Affected versions are 16.0.0 through 16.2.10 — the 15.x line is not in scope for this one.

The workaround, if you cannot upgrade immediately, is the same advice that has followed every middleware bypass in this framework: enforce authorization in the page's server-side data path, not only in middleware.ts.

SSRF through rewrite and redirect destinations

CVE-2026-64645 (CVSS 8.3) hits any application whose rewrites() or redirects() build an external destination hostname out of a dynamic segment:

// vulnerable if :tenant comes from the request path or a header capture
destination: 'https://:tenant.api.example.com'

An attacker who controls that segment can point the outbound request at an arbitrary host — server-side request forgery for rewrites, an open redirect for redirects. The affected range is unusually wide: >= 12.0.0 < 15.5.21 and >= 16.0.0 < 16.2.11. If you need the dynamic subdomain, constrain the capture to hostname-safe characters, e.g. value: '(?<region>[a-z0-9-]+)'.

SSRF in Server Actions on custom servers

CVE-2026-64649 (CVSS 8.3) applies when Server Actions forward or redirect a request and the incoming host header is not pinned to a trusted value. Managed platforms pin the host upstream; a custom server behind your own proxy usually does not. Affected: >= 14.1.1 < 15.5.21 and >= 16.0.0 < 16.2.11.

Two mitigations exist short of upgrading — validate or pin the host header at the edge, or set __NEXT_PRIVATE_ORIGIN to your deployment's real origin before starting the server (14.2.0 and later).

CPU exhaustion via Server Actions

CVE-2026-64641 (CVSS 8.2) needs only that your App Router app defines at least one Server Action. Crafted requests drive excessive CPU usage and block every other request in the same process. The advisory classifies it as CWE-834, excessive iteration, and lists no workaround — Pages Router applications and apps with no Server Actions simply are not vulnerable. Everyone else patches.

The five Moderate issues

  • CVE-2026-64646 (6.3) — unbounded Server Action payloads on the Edge runtime allow memory exhaustion.
  • CVE-2026-64644 (6.3) — DoS in the Image Optimization API via SVG input. Only self-hosted deployments using the default loader with images.remotePatterns are affected; config.experimental.imgOptSkipMetadata is the stopgap.
  • CVE-2026-64643 (6.3) — internal Server Function and cache endpoint IDs are discoverable in public client artifacts by unauthenticated users. On its own it is reconnaissance, which is exactly why authentication belongs inside the server function rather than on the page that renders it.
  • CVE-2026-64648 (6.0) — a server-side fetch carrying a request body can receive a cached response body belonging to a different request to the same URL.
  • CVE-2026-64647 (6.3) — the same cache confusion, triggered by invalid UTF-8 byte sequences in the request body.

The two cache-confusion bugs are the ones worth reading carefully. They are rated Moderate, but "the right URL returns another request's response body" is a data-leak shape, and its blast radius depends entirely on what your app fetches server-side.

What to upgrade to

# 16.x line
npm install next@16.2.11

# 15.5 line
npm install next@15.5.21

Two notes on version choice. First, the 16.x advisories cap their affected ranges at 16.2.10, so the 16.3 line — stable since August 3 — already carries these fixes. Second, do not pin to exactly 15.5.21: that line has kept moving, and 15.5.23 (August 7) ports the ReplyServer traversal guards to FlightClient. Take the latest patch in whichever minor you are on.

After upgrading, the useful follow-up work is auditing where authorization actually happens. Both the middleware bypass and the Server Function disclosure punish the same design: a protected route whose only guard runs in middleware. That pattern has now failed in the May 2026 batch and again here.

Primary sources: the Next.js security advisories on GitHub and the July 2026 Security Release announcement.

Running a self-hosted Next.js deployment and unsure which of these apply to your configuration? Get in touch — we audit and upgrade Next.js applications for a living.

All posts