CVE-2026-64649: 
Wolfi vulnerability analysis and mitigation

CVE-2026-64649 is a Server-Side Request Forgery (SSRF) vulnerability in Next.js Server Actions on custom servers. When a Server Action forwards or redirects a request, an attacker who controls Host-associated headers can cause the server to send outbound requests to a malicious host. Affected versions are next (npm) >= 14.1.1 and < 15.5.21, and >= 16.0.0 and < 16.2.11. The vulnerability was published on July 21, 2026, and patched versions were released the same day. It carries a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery). In the vulnerable code path within src/server/app-render/action-handler.ts, the origin used for forwarded Server Action requests and internal redirects was constructed using attacker-controllable Host or X-Forwarded-Host headers (e.g., ${proto}://${host.value}) rather than a trusted, server-side-determined value. The fix replaces this logic with origin derivation from the internal initURL request metadata, which is not attacker-controlled, or falls back to the __NEXT_PRIVATE_ORIGIN environment variable (GitHub Advisory, 15.x patch commit, 16.x patch commit). Exploitation requires the attacker to control the Host or X-Forwarded-Host header received by the application, which is possible on custom servers or deployments not behind a host-pinning proxy. In some configurations, exploitation can also leak internal values that weaken middleware or proxy authorization (GitHub Advisory).

A successful exploit allows an unauthenticated attacker to cause the Next.js server to issue arbitrary HTTP requests to attacker-controlled or internal hosts, enabling access to internal services, metadata endpoints (e.g., cloud IMDS), or other resources not intended to be publicly reachable. The primary impact is high confidentiality loss on the vulnerable system (e.g., exfiltration of internal data or credentials), with a low integrity impact due to potential unauthorized interactions with internal services. Availability is not directly impacted, but lateral movement within internal networks is a realistic secondary risk (GitHub Advisory).

1. Identify a vulnerable target: Find a Next.js application running on a custom server (not managed hosting, next start, or standalone output from v14.2+) with versions >= 14.1.1 and < 15.5.21, or >= 16.0.0 and < 16.2.11, that uses Server Actions.
2. Confirm host header control: Verify that the application reflects or uses the Host or X-Forwarded-Host header without pinning it to a trusted value — this is typical when no reverse proxy enforces a fixed host.
3. Craft a malicious request: Send an HTTP request to a Server Action endpoint that triggers a forward or redirect, setting the Host header (or X-Forwarded-Host) to an attacker-controlled hostname (e.g., attacker.example.com).
4. Trigger SSRF: The server constructs the forwarded request origin using the attacker-supplied header, causing it to send an outbound HTTP request to https://attacker.example.com/... instead of the legitimate internal origin.
5. Collect data: Monitor the attacker-controlled server for incoming requests, which may include internal tokens, authorization headers, or other sensitive values passed in the forwarded request (GitHub Advisory, 15.x patch commit).

• Network: Unexpected outbound HTTP/HTTPS requests from the Next.js server process to external or unusual internal hosts, particularly originating from Server Action handler code paths.
• Network: Incoming requests to attacker-controlled infrastructure containing internal authorization headers, tokens, or metadata that would only be present in server-to-server forwarded requests.
• Logs: Application or access logs showing Server Action requests (typically POST to /_next/action or similar endpoints) with anomalous or external Host / X-Forwarded-Host header values.
• Logs: Error log entries referencing Could not determine origin for forwarded Server Actions request on unpatched versions, which may indicate probing activity.
• Process: Unusual outbound network connections from the Node.js process hosting Next.js to IP addresses or hostnames not in the expected service topology.

Upgrade Next.js to version 15.5.21 (for the 15.x branch) or 16.2.11 (for the 16.x branch), which fix the origin derivation logic to use server-side initURL metadata instead of attacker-controllable headers (v15.5.21 release, v16.2.11 release). If upgrading immediately is not possible, pin or validate the Host and X-Forwarded-Host headers at your edge or reverse proxy so clients cannot control the value received by the application. On Next.js 14.2.0 and later, you can also set the __NEXT_PRIVATE_ORIGIN environment variable to your deployment's real origin as an additional mitigation: __NEXT_PRIVATE_ORIGIN=https://www.example.com node server.js (GitHub Advisory). Applications on managed hosting (e.g., Vercel), or using next start / standalone output from v14.2+, are not affected as the host is pinned upstream.

The vulnerability was part of a broader Next.js July 2026 security release that addressed multiple high and moderate severity issues simultaneously, including other SSRF, DoS, and cache confusion vulnerabilities (v15.5.21 release, v16.2.11 release). Cloudflare's WAF and Netlify both published changelog entries acknowledging the Next.js security vulnerabilities around the same time as the advisory, indicating rapid response from major hosting and CDN providers. No significant independent researcher commentary or social media discussion specific to CVE-2026-64649 has been identified beyond the advisory itself.