PT-2026-25908 · Npm · Next

Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-27977

OSV

CVSS v4.0

2.3

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

In next dev, cross-site protection for internal websocket endpoints could treat Origin: null as a bypass case even if allowedDevOrigins is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly.

Impact

If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured allowedDevOrigins still allow connections from any origin.

Patches

Fixed by validating Origin: null through the same cross-site origin-allowance checks used for other origins.

Workarounds

If upgrade is not immediately possible:

• Do not expose next dev to untrusted networks.
• Block websocket upgrades to / next/webpack-hmr when Origin is null at your proxy.

Fix

Weakness Enumeration

CWE-1385

Related Identifiers

CVE-2026-27977

GHSA-JCC7-9WPM-MJ36

Affected Products

Next

References · 5

• https://osv.dev/vulnerability/GHSA-jcc7-9wpm-mj36 · Vendor Advisory
• https://github.com/vercel/next.js · Note
• https://github.com/vercel/next.js/releases/tag/v16.1.7 · Note
• https://github.com/vercel/next.js/security/advisories/GHSA-jcc7-9wpm-mj36 · Note
• https://github.com/vercel/next.js/commit/862f9b9bb41d235e0d8cf44aa811e7fd118cee2a · Note