PT-2026-63564 · Npm · Next
CVE-2026-64649
·
Published
2026-07-22
·
Updated
2026-07-22
CVSS v4.0
8.3
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
Impact
When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.
Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected;
next start and standalone output do the same from version 14.2 onward.Workarounds
If you cannot upgrade, ensure clients do not control the host header your application receives. Pin or validate
Host and X-Forwarded-Host at your edge or proxy. On version 14.2.0 and later, you can additionally set the NEXT PRIVATE ORIGIN environment variable to your deployment's real origin:bash
NEXT PRIVATE ORIGIN=https://www.example.com node server.jsFix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Next