CVE-2026-27977: Next.js: null origin can bypass dev HMR websocket CSRF checks
Summary In next dev, cross-site protection for internal websocket endpoints could treat Origin: null as a bypass case even if allowedDevOrigins is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly.
Impact If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured allowedDevOrigins still allow connections from any origin.
Patches Fixed by validating Origin: null through the same cross-site origin-allowance checks used for other origins.
Workarounds If upgrade is not immediately possible: - Do not expose next dev to untrusted networks. - Block websocket upgrades to /next/webpack-hmr when Origin is null at your proxy.
Other sources
Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in next dev, cross-site protection for internal websocket endpoints could treat Origin: null as a bypass case even if allowedDevOrigins is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured allowedDevOrigins still allow connections from any origin. The issue is fixed in version 16.1.7 by validating Origin: null through the same cross-site origin-allowance checks used for other origins. If upgrading is not immediately possible, do not expose next dev to untrusted networks and/or block websocket upgrades to /next/webpack-hmr when Origin is null at the proxy.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27977?
CVE-2026-27977 has been assessed to have a moderate severity level due to potential privacy-sensitive implications.
How do I fix CVE-2026-27977?
To mitigate CVE-2026-27977, upgrade to Next.js version 16.1.7 or higher as this version includes a fix for the vulnerability.
What type of vulnerability is CVE-2026-27977?
CVE-2026-27977 is a cross-site protection vulnerability affecting internal websocket endpoints in Next.js.
What versions of Next.js are affected by CVE-2026-27977?
CVE-2026-27977 affects Next.js versions between 16.0.1 and 16.1.6 inclusive.
What are the potential consequences of CVE-2026-27977?
Exploitation of CVE-2026-27977 could lead to insecure handling of cross-origin requests, compromising the privacy and security of applications.