CVE-2026-64643: Next.js: Unauthenticated Disclosure of Internal Server Function endpoints
Impact
In Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used.
Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references).
Affected users are applications using App Router + Server Actions.
By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. Workarounds
Never assume any authentication claims at the use cache or use server boundary. Always authenticate within the boundary.
Other sources
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.2.11 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.5.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.2.11 - Compensating control
Always authenticate within the boundary, and never assume any authentication claims at the use cache or use server boundary for Next.js App Router Server Actions / use cache endpoints.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64643?
CVE-2026-64643 has a risk rating of 37, indicating a significant vulnerability.
How do I fix CVE-2026-64643?
To mitigate CVE-2026-64643, ensure proper authentication checks are implemented for Server Actions and cache endpoints.
What types of applications are affected by CVE-2026-64643?
CVE-2026-64643 affects Next.js applications that utilize the App Router, Server Actions, or use cache endpoints.
What happens if I don't address CVE-2026-64643?
Failing to address CVE-2026-64643 can lead to unauthorized access to sensitive Server Action IDs by unauthenticated users.
When was CVE-2026-64643 published?
CVE-2026-64643 was published on July 22, 2026.