CVE-2026-64649: Next.js: Server-Side Request Forgery in Server Actions on Custom Servers
Impact
When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.
Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward.
Workarounds
If you cannot upgrade, ensure clients do not control the host header your application receives. Pin or validate Host and X-Forwarded-Host at your edge or proxy. On version 14.2.0 and later, you can additionally set the NEXTPRIVATEORIGIN environment variable to your deployment's real origin:
bash NEXTPRIVATEORIGIN=https://www.example.com node server.js
Other sources
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.2.11 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.5.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.2.11 - Configuration
Pin or validate the incoming Host header and X-Forwarded-Host header at your edge or proxy so clients cannot control the host-associated headers your application receives.
Next.js (custom server) Host and X-Forwarded-Host = Pinned/validated to a trusted value at edge or proxy - Configuration
On Next.js version 14.2.0 and later, set the __NEXT_PRIVATE_ORIGIN environment variable to your deployment's real origin to help prevent SSRF in Server Actions on custom servers.
Next.js __NEXT_PRIVATE_ORIGIN = Set to your deployment's real origin (example: https://www.example.com) - Compensating control
If you cannot upgrade, ensure clients do not control the Host header your application receives (especially for custom servers or deployments not behind a proxy that pins the host).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64649?
CVE-2026-64649 has a risk score of 47.
What impact does CVE-2026-64649 have on server security?
CVE-2026-64649 can lead to Server-Side Request Forgery, allowing attackers to send outbound requests to a malicious host.
How can I fix CVE-2026-64649 in npm/next applications?
To mitigate CVE-2026-64649, ensure that Host-associated headers are properly validated and sanitized.
What type of vulnerability is CVE-2026-64649 classified as?
CVE-2026-64649 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
When was CVE-2026-64649 published?
CVE-2026-64649 was published on July 22, 2026.