Server-Side Request Forgery in Next.js Framework by Vercel

CVE-2026-64649

What is CVE-2026-64649?

A Server-Side Request Forgery vulnerability has been identified in the Next.js framework affecting specific versions. When a Server Action performs a redirect or forwards a request, an attacker can manipulate the server into making an outbound request to a malicious host. This exploit hinges on controlling the Host-associated headers of the incoming request. In configurations lacking a fixed host header or not utilizing a properly secured proxy, there’s a risk that internal values may be exposed, potentially compromising middleware or proxy authorizations. This issue primarily impacts custom server deployments, but managed hosting environments that enforce host pinning are not susceptible. The vulnerability has been rectified in subsequent releases.

References