CVE-2026-64649: 
Wolfi vulnerability analysis and mitigation

CVE-2026-64649 is a Server-Side Request Forgery (SSRF) vulnerability in Vercel's Next.js React framework affecting Server Actions on custom servers. When a Server Action forwards or redirects a request, an attacker who controls Host-associated headers can cause the server to send outbound requests to an attacker-controlled host. Affected versions are 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10; patched versions are 15.5.21 and 16.2.11. The vulnerability was published on July 21–22, 2026, and carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 8.3 (High) (GitHub Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery). In vulnerable versions, the createForwardedActionResponse and createRedirectRenderResult functions in action-handler.ts constructed the outbound request origin using attacker-controllable Host or X-Forwarded-Host headers — specifically via the pattern ${proto}://${host.value} — rather than a trusted, server-side-determined origin (GitHub Commit 15.x, GitHub Commit 16.x). The fix replaces this logic with origin derivation from the server's internal initURL metadata, which is not attacker-controlled. Exploitation requires no authentication and no user interaction, but does require that the deployment does not pin or validate the incoming Host header — a condition common in custom server setups or deployments not behind a host-pinning reverse proxy (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to force the Next.js server to send outbound HTTP requests to an arbitrary attacker-controlled host, enabling classic SSRF attack scenarios such as probing internal network services, exfiltrating request metadata, or reaching cloud instance metadata endpoints. In some configurations, attackers may also obtain internal values (e.g., authorization tokens or secrets) used by middleware or proxy layers, weakening downstream authorization controls. Availability is not directly impacted, but confidentiality and integrity of server communications are at risk (GitHub Advisory).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.622%, indicating a low but non-negligible probability of exploitation in the near term. The attack requires no privileges or user interaction but does require a specific deployment configuration (custom server or no host-pinning proxy), which limits the exposed attack surface.

1. Reconnaissance: Identify Next.js applications running versions 14.1.1–15.5.20 or 16.0.0–16.2.10 on custom servers or without a host-pinning reverse proxy, using tools like Shodan, Censys, or HTTP fingerprinting.
2. Confirm Server Actions usage: Interact with the target application to identify endpoints that invoke Next.js Server Actions (typically POST requests to pages using the 'use server' directive).
3. Craft malicious Host header: Prepare an HTTP request to a Server Action endpoint that includes a manipulated Host or X-Forwarded-Host header pointing to an attacker-controlled server (e.g., Host: attacker.example.com).
4. Trigger forwarded/redirect action: Submit the crafted request to a Server Action that internally forwards or redirects the request. The vulnerable code constructs the outbound origin from the attacker-supplied header.
5. Capture outbound request: On the attacker-controlled server, capture the incoming request from the Next.js server, which may include internal authorization headers, tokens, or other sensitive values passed along with the forwarded request.
6. Leverage captured data: Use any obtained internal tokens or values to bypass middleware/proxy authorization, probe internal services, or escalate access within the target environment (GitHub Advisory, GitHub Commit 15.x).

• Network: Unexpected outbound HTTP/HTTPS requests from the Next.js server to external or unknown hosts, particularly originating from Server Action processing; connections to attacker-controlled infrastructure from the application server.
• Logs: Server access logs showing POST requests to Server Action endpoints with anomalous or external Host or X-Forwarded-Host header values; application error logs containing messages such as "Could not determine origin for forwarded Server Actions request" on unpatched versions.
• Application Behavior: Server Action forwarding or redirect failures with unexpected destination hostnames; internal authorization errors or token leakage reported by downstream proxies or middleware.

Upgrade to Next.js version 15.5.21 or 16.2.11, which fix the vulnerability by deriving the outbound request origin from the server's internal initURL metadata rather than client-supplied headers (v15.5.21 Release, v16.2.11 Release). If immediate upgrade is not possible, pin or validate the Host and X-Forwarded-Host headers at your edge or reverse proxy to ensure only trusted values reach the application. On Next.js 14.2.0 and later, you can also set the __NEXT_PRIVATE_ORIGIN environment variable to your deployment's real origin (e.g., __NEXT_PRIVATE_ORIGIN=https://www.example.com node server.js) as an interim workaround. Managed hosting environments (e.g., Vercel platform), next start, and standalone output from version 14.2 onward are not affected as they pin the host upstream (GitHub Advisory).

The vulnerability was part of a broader July 2026 Next.js security release that addressed nine security flaws, receiving coverage from multiple cybersecurity news outlets including CyberSecurityNews, GBHackers, and SecurityOnline (CyberSecurityNews). Netlify published a changelog entry acknowledging the Next.js security vulnerabilities and their platform's handling (Netlify Changelog). The Next.js team published an official security release blog post detailing all nine advisories (Next.js Blog). Community reaction was moderate, with the release noted in weekly threat landscape digests and security newsletters.