Critical Next.js Flaws Let Attackers Bypass Authentication and Launch SSRF Attacks

Vercel has disclosed nine security vulnerabilities in Next.js, the widely used React framework, including two critical-severity flaws that allow attackers to bypass authentication middleware and hijack server-side requests. The advisories, published by researcher KarimPwnz, affect versions ranging from 12.0.0 through 16.2.10, with patches available in 15.5.21 and 16.2.11. The most severe issue, tracked as CVE-2026-64642 […] The post Critical Next.js Flaws Let Attackers Bypass Authentication and Launch SSRF Attacks appeared first on Cyber Security News.

Vercel has disclosed nine security vulnerabilities in Next.js, the widely used React framework, including two critical-severity flaws that allow attackers to bypass authentication middleware and hijack server-side requests. The advisories, published by researcher KarimPwnz, affect versions ranging from 12.0.0 through 16.2.10, with patches available in 15.5.21 and 16.2.11. The most severe issue, tracked as CVE-2026-64642 (CVSS 4.0, High), affects App Router applications built with Turbopack that use a single locale entry in config.i18n.locales. Critical Next.js Flaws Crafted requests can bypass middleware and proxy-based authentication entirely, granting unauthorized access to protected routes (CWE-285: Improper Authorization). Organizations relying solely on middleware for access control should treat this as urgent and enforce authorization checks directly in the server-side data path as an interim mitigation. CVE-2026-64645 (CVSS 4.0, High) impacts rewrites() and redirects() configurations that build destination hostnames from request-controlled input, such as dynamic path segments or has captures. Attackers can redirect the hostname to an arbitrary destination, causing Next.js to proxy requests to malicious hosts while serving responses from the application’s own origin, a textbook SSRF (CWE-918). A related flaw, CVE-2026-64649, affects Server Actions on custom servers where the Host header isn’t pinned, similarly enabling SSRF and potential internal value disclosure. Vercel-managed hosting and standard next start deployments from 14.2 onward are not affected. Denial-of-Service and Cache Confusion Issues Several moderate-to-high severity bugs round out the disclosure: CVE IDSeverityVulnerabilityCWECVE-2026-64641HighApp Router Server Actions can trigger excessive CPU usage, blocking request processingCWE-834CVE-2026-64646ModerateServer Actions on the Edge runtime lack payload size limits, enabling memory exhaustionCWE-770CVE-2026-64644ModerateImage Optimization API can be abused via malicious remote SVGs to exhaust CPU resourcesNo CWE assignedCVE-2026-64648ModerateCache confusion in server-side fetch() calls leaks confidential response bodies across unrelated requestsNo CWE assignedCVE-2026-64647ModerateCache confusion variant triggered by invalid UTF-8 byte sequences in request bodiesCWE-116CVE-2026-64643ModerateServer Action IDs disclosed through public client-side chunks, aiding reconnaissance against use server and use cache boundariesCWE-201 According to KarimPwnz advisory, urges all users to upgrade immediately to Next.js 15.5.21 or 16.2.11, depending on their major version track. If upgrading isn’t immediately possible, teams should restrict dynamic hostnames in rewrite/redirect rules, pin the Host and X-Forwarded-Host headers at the proxy layer, limit Edge Server Action payload sizes, and validate authentication explicitly within use server and use cache boundaries. Since this batch combines an authentication bypass with multiple SSRF flaws, patching should take priority over workarounds for self-hosted or custom-server deployments. Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN. The post Critical Next.js Flaws Let Attackers Bypass Authentication and Launch SSRF Attacks appeared first on Cyber Security News.