CVE-2026-27978: 
ASP.NET Core vulnerability analysis and mitigation

CVE-2026-27978 is a Cross-Site Request Forgery (CSRF) bypass vulnerability in Next.js Server Actions, where origin: null was incorrectly treated as a "missing" origin rather than an explicit opaque origin during CSRF validation. This allows requests originating from privacy-sensitive contexts — such as sandboxed iframes — to bypass origin verification and be processed as if they were same-origin requests. The vulnerability affects Next.js versions 16.0.1 through 16.1.6 (npm package next). It was published on March 16, 2026, and patched in version 16.1.7. The CVSS v4 base score is 5.3 (Medium) (Github Advisory, Vercel Advisory).

The root cause is an Origin Validation Error (CWE-346) combined with a CSRF weakness (CWE-352) in Next.js's Server Action request handler (packages/next/src/server/app-render/action-handler.ts). Prior to the fix, the code explicitly excluded the string 'null' when parsing the Origin header — treating it as if no origin was present — rather than recognizing it as a valid opaque origin sent by sandboxed iframes. Because the missing-origin code path skipped host/origin comparison checks, a sandboxed iframe (which browsers assign the opaque null origin) could submit Server Actions cross-origin without triggering CSRF rejection. The fix in commit a27a11d treats 'null' as an explicit origin value and enforces host/origin checks against it unless 'null' is explicitly listed in experimental.serverActions.allowedOrigins (Vercel Advisory, Patch Commit). A proof-of-concept repository was later published at github.com/Nayekah/Next.js-Proof-of-Concept.

Successful exploitation allows an attacker to induce a victim's browser to submit Next.js Server Actions from a sandboxed iframe context, executing state-changing operations with the victim's authenticated session credentials. This could result in unauthorized data modification, financial transactions, account setting changes, or other sensitive operations performed without the user's knowledge or consent. There is no direct confidentiality or availability impact — the primary risk is integrity loss through unauthorized action execution (Github Advisory, Vercel Advisory).

As of the time of disclosure, there is no evidence of active in-the-wild exploitation or a weaponized exploit kit. A proof-of-concept repository (github.com/Nayekah/Next.js-Proof-of-Concept) appeared in Feedly tracking data in late May 2026, indicating public PoC availability. The EPSS score is approximately 0.009% (1st percentile), reflecting low near-term exploitation probability. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Identify a target: Locate a Next.js application running versions 16.0.1–16.1.6 that uses Server Actions for state-changing operations (e.g., account updates, form submissions, financial actions).
2. Craft a malicious page: Create an attacker-controlled web page containing a sandboxed iframe. The iframe must be sandboxed in a way that causes the browser to assign it an opaque (null) origin — for example, using a Content-Security-Policy: sandbox allow-forms header or the sandbox attribute on the <iframe> element.
3. Embed a Server Action form: Inside the sandboxed iframe, embed an HTML form or JavaScript that targets the victim Next.js application's Server Action endpoint, pre-populated with the desired malicious parameters.
4. Induce victim interaction: Trick the authenticated victim into visiting the attacker's page (e.g., via phishing). The sandboxed iframe submits the Server Action request with Origin: null in the HTTP headers, along with the victim's session cookies.
5. Bypass CSRF validation: The vulnerable Next.js server receives the request, sees Origin: null, treats it as a missing origin (skipping host/origin comparison), and processes the Server Action as if it were a legitimate same-origin request.
6. Achieve objective: The Server Action executes with the victim's credentials, performing the attacker's desired state-changing operation (e.g., changing account email, submitting a transaction) (Vercel Advisory, Patch Commit).

• Network: Unexpected HTTP POST requests to Next.js Server Action endpoints with an Origin: null header and valid session cookies attached; requests originating from unusual referrers or with no Referer header.
• Logs: Server-side Next.js logs showing Server Action invocations with Origin: null that do not correspond to known sandboxed iframe use cases; absence of a Referer header alongside Origin: null in access logs.
• Application Behavior: Unexpected state changes in application data (e.g., account modifications, unauthorized transactions) that correlate with user sessions but were not initiated by the user; audit logs showing actions performed at unusual times or from unexpected contexts.

Upgrade Next.js to version 16.1.7 or later, which treats 'null' as an explicit origin value and enforces host/origin checks for requests from opaque contexts (Vercel Release, Github Advisory). If immediate upgrade is not possible, apply the following mitigations:

• Add explicit CSRF tokens to sensitive Server Actions.
• Set SameSite=Strict on sensitive authentication cookies to prevent cross-site cookie transmission.
• Do not add 'null' to experimental.serverActions.allowedOrigins unless explicitly required and protected by additional controls.

The advisory was published by Vercel maintainer ztanner on March 16, 2026, as part of a coordinated release that also addressed four other CVEs (CVE-2026-27977, CVE-2026-27979, CVE-2026-27980, CVE-2026-29057) in the same v16.1.7 patch release (Vercel Release). Red Hat tracked the issue via Bugzilla (Bug 2448513) with medium severity, indicating downstream ecosystem awareness (Red Hat Bugzilla). Community reaction on the GitHub release was positive, with 18 users reacting to the v16.1.7 release notes.