{"id":"CVE-2026-64649","sourceIdentifier":"security-advisories@github.com","published":"2026-07-27T20:16:40.703","lastModified":"2026-10-24T13:10:00.147","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11."},{"lang":"es","value":"Next.js es un React framework para construir aplicaciones web full-stack. En las versiones 14.1.1 hasta 15.5.20 y 16.0.0 hasta 16.2.10, cuando una Server Action reenvía o redirige una petición, un atacante puede hacer que el servidor envíe esa petición saliente a un host malicioso (falsificación de petición del lado del servidor). Esto requiere que la petición del atacante controle los encabezados asociados al Host. En algunas configuraciones, también es posible obtener valores internos que debilitan la autorización de middleware/proxy. Las aplicaciones que usan Server Actions se ven afectadas cuando el encabezado de host entrante no está fijado a un valor de confianza. Esto ocurre típicamente en servidores personalizados, o en despliegues que no están detrás de un proxy que fija el host. El hosting gestionado fija el host en la capa superior y no se ve afectado; next start y la salida standalone hacen lo mismo a partir de la versión 14.2. Este problema ha sido solucionado en las versiones 15.5.21 y 16.2.11."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vercel","product":"next.js","versions":[{"version":">= 14.1.1, < 15.5.21","status":"affected"},{"version":">= 16.0.0 < 16.2.11","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-28T14:11:48.555168Z","id":"CVE-2026-64649","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*","versionStartIncluding":"14.1.1","versionEndExcluding":"15.5.21","matchCriteriaId":"5D744B30-6CEE-4650-8D9D-7B829761B9D2"},{"vulnerable":true,"criteria":"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.2.11","matchCriteriaId":"841758BF-9324-4127-B087-6A8C1BADB389"}]}]}],"references":[{"url":"https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/vercel/next.js/releases/tag/v15.5.21","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/vercel/next.js/releases/tag/v16.2.11","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}