{"id":"CVE-2026-64643","sourceIdentifier":"security-advisories@github.com","published":"2026-07-27T18:16:59.160","lastModified":"2026-10-24T13:10:00.147","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11."},{"lang":"es","value":"Next.js es un framework de React para construir aplicaciones web full-stack. En las versiones 12.0.0 a 15.5.20 y 16.0.0 a 16.2.10, las aplicaciones Next.js que utilizan App Router, Server Actions (use server) o endpoints de caché pueden ser divulgadas, omitiendo cualquier autenticación en las páginas donde estos endpoints se utilizan habitualmente. Los IDs de Server Action pueden ser divulgados a usuarios no autenticados a través de artefactos de cliente servidos públicamente (por ejemplo, fragmentos estáticos que contienen referencias de acción). Los usuarios afectados son las aplicaciones que utilizan App Router y Server Actions. Por sí misma, esta divulgación es típicamente una primitiva de reconocimiento/enumeración; sin embargo, puede aumentar el riesgo cuando se combina con otras debilidades. Este problema ha sido solucionado en las versiones 15.5.21 y 16.2.11."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vercel","product":"next.js","versions":[{"version":">= 13.0.0, < 15.5.21","status":"affected"},{"version":">= 16.0.0, < 16.2.11","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-27T18:20:57.639287Z","id":"CVE-2026-64643","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*","versionStartIncluding":"13.0.0","versionEndExcluding":"15.5.21","matchCriteriaId":"A35AD882-35BE-4B3B-8BBC-11ED8E8E1336"},{"vulnerable":true,"criteria":"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.2.11","matchCriteriaId":"841758BF-9324-4127-B087-6A8C1BADB389"}]}]}],"references":[{"url":"https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/vercel/next.js/releases/tag/v15.5.21","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/vercel/next.js/releases/tag/v16.2.11","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}