PT-2026-63564 · Npm · Next
CVE-2026-64649
·
Publicado
2026-07-22
·
Atualizado
2026-07-22
CVSS v4.0
8.3
Alta
| Vetor | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
Impact
When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.
Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected;
next start and standalone output do the same from version 14.2 onward.Workarounds
If you cannot upgrade, ensure clients do not control the host header your application receives. Pin or validate
Host and X-Forwarded-Host at your edge or proxy. On version 14.2.0 and later, you can additionally set the NEXT PRIVATE ORIGIN environment variable to your deployment's real origin:bash
NEXT PRIVATE ORIGIN=https://www.example.com node server.jsCorreção
SSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Next