The Next.js team has disclosed nine security vulnerabilities, all patched in 15.5.21 and 16.2.11. The issues span server-side request forgery (SSRF), a middleware authorization bypass, denial of service (DoS), and cache/identifier disclosure. Here's what Netlify customers need to know. Summary If you run Next.js on Netlify, upgrade next to 15.5.21 or 16.2.11 and redeploy. Netlify-hosted sites are not affected by three of these (Server Action Host forwarding, the Image Optimizer DoS, and the Edge-runtime OOM). The rest affect only apps using a specific pattern or configuration, and are resolved by upgrading — see Impact on Netlify for the per-issue verdict. Vulnerabilities All issues are patched in 15.5.21 and 16.2.11. Earlier minors of 15.x and 16.x will not be patched; affected projects must upgrade to a patched minor. Follow the GHSA links for full details. Vulnerability: CVE-2026-64645 / GHSA-p9j2-gv94-2wf4 — Server-Side Request Forgery in rewrites via attacker-controlled destination hostname Severity: High Affected versions: ≥12.0.0 GHSA-89xv-2m56-2m9x — Server-Side Request Forgery in Server Actions on custom servers Severity: High Affected versions: ≥14.1.1 GHSA-6gpp-xcg3-4w24 — Middleware / Proxy bypass in App Router applications using Turbopack and single locale Severity: High Affected versions: ≥16.0.0 GHSA-m99w-x7hq-7vfj — Denial of Service in App Router using Server Actions Severity: High Affected versions: ≥13.0.0 GHSA-q8wf-6r8g-63ch — Denial of Service in the Image Optimization API using SVGs Severity: Medium Affected versions: ≥15.5.0 GHSA-4c39-4ccg-62r3 — Unbounded Server Action payload in Edge runtime Severity: Medium Affected versions: ≥13.0.0 GHSA-68g3-v927-f742 — Cache confusion of response bodies for requests with bodies Severity: Medium Affected versions: ≥13.0.0 GHSA-4633-3j49-mh5q — Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences Severity: Medium Affected versions: ≥13.0.0 GHSA-955p-x3mx-jcvp — Unauthenticated disclosure of internal Server Function endpoints Severity: Medium Affected versions: ≥13.0.0 GHSA-p9j2-gv94-2wf4 (Server-Side Request Forgery in rewrites via attacker-controlled destination hostname): Netlify sites are affected if a rewrites() or redirects() rule builds the destination hostname from request input (static destinations are not). Upgrading Next.js resolves it. CVE-2026-64649 / GHSA-89xv-2m56-2m9x (Server-Side Request Forgery in Server Actions on custom servers): Netlify sites are not affected — our edge overwrites inbound X-Forwarded-Host with the real host, so an attacker cannot redirect the Server Action's outbound request to a host they control. Middleware authorization bypass CVE-2026-64642 / GHSA-6gpp-xcg3-4w24 (Middleware / Proxy bypass in App Router applications using Turbopack and single locale): Netlify sites are affected if they build with Turbopack and use the legacy middleware.ts convention with single-locale i18n. Webpack builds and the newer proxy.ts convention are not affected. Upgrading Next.js resolves it. Denial of service CVE-2026-64641 / GHSA-m99w-x7hq-7vfj (Denial of Service in App Router using Server Actions) and CVE-2026-64646 / GHSA-4c39-4ccg-62r3 (Unbounded Server Action payload in Edge runtime) are server-side DoS. On Netlify these have minimal impact: our autoscaling architecture means a hung or crashed function does not affect other requests, though active exploitation could increase your function costs. The Edge-runtime OOM specifically cannot exhaust memory on Netlify — request bodies are capped and each request runs in an isolated invocation. Upgrading Next.js resolves both. CVE-2026-64644 / GHSA-q8wf-6r8g-63ch (Denial of Service in the Image Optimization API using SVGs): Netlify sites are not affected — /_next/image is served by Netlify Image CDN, so the vulnerable Next.js code path is not used. Cache disclosure / confusion CVE-2026-64648 / GHSA-68g3-v927-f742 (Cache confusion of response bodies for requests with bodies) and CVE-2026-64647 / GHSA-4633-3j49-mh5q (Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences): Netlify sites are affected if they use the specific cached-fetch patterns — a cached fetch(new Request(url), init), or a cached binary-body POST fetch(). fetch(url, init) and cache: 'no-store' are not affected. Upgrading Next.js resolves both. Information disclosure CVE-2026-64643 / GHSA-955p-x3mx-jcvp (Unauthenticated disclosure of internal Server Function endpoints): Netlify sites are affected (low impact) if they use Cache Components with a reflective Server Action co-bundled alongside a use cache function. The leak is limited to opaque internal function identifiers — no credentials or PII. Upgrading Next.js resolves it. What should I do? We strongly recommend upgrading as soon as possible:
Continue reading...
- Upgrade next to 15.5.21 or 16.2.11, then redeploy.
- Next.js July 2026 security release
- Next.js security advisories
Continue reading...