chore(deps): update dependency next to v16.2.11 [security] - #8822
Merged
Conversation
MarcusNotheis
approved these changes
Jul 27, 2026
Contributor
|
Size Change: +6 B (0%) Total Size: 522 kB 📦 View Changed
ℹ️ View Unchanged
|
renovate
Bot
force-pushed
the
renovate/npm-next-vulnerability
branch
from
July 27, 2026 08:58
bdce0af to
1b02320
Compare
Coverage Report for CI Build 30252000001Coverage remained the same at 85.502%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
16.2.10→16.2.11Next.js: Denial of Service in App Router using Server Actions
CVE-2026-64641 / GHSA-m99w-x7hq-7vfj
More information
Details
Impact
Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.
Workarounds
No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
CVE-2026-64642 / GHSA-6gpp-xcg3-4w24
More information
Details
Impact
Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in
config.i18n.localescan bypass middleware/proxy based authentication.Workarounds
If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Next.js: Unauthenticated disclosure of internal Server Function endpoints
CVE-2026-64643 / GHSA-955p-x3mx-jcvp
More information
Details
Impact
In Next.js applications using App Router, Server Actions (
use server) oruse cacheendpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used.Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references).
Affected users are applications using App Router + Server Actions.
By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses.
Workarounds
Never assume any authentication claims at the
use cacheoruse serverboundary. Always authenticate within the boundary.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Next.js: Denial of Service in the Image Optimization API using SVGs
CVE-2026-64644 / GHSA-q8wf-6r8g-63ch
More information
Details
Impact
When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in
/_next/imageendpoints.config.images.remotePatterns, only the patterns in that array are impacted.config.images.unoptimized: true, you are NOT impacted.config.images.loader: 'custom', you are NOT impacted.Workarounds
If you cannot upgrade immediately, you can avoid the expensive work by setting
config.experimental.imgOptSkipMetadata : true.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
CVE-2026-64645 / GHSA-p9j2-gv94-2wf4
More information
Details
Impact
A
rewrites()orredirects()rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. Aredirects()rule configured this way is vulnerable to an Open Redirect.This affects any destination that puts a dynamic segment in the hostname, whether from the path:
or from a
hascapture:Workarounds
If you cannot upgrade immediately, do not build the hostname of an external
rewrites()orredirects()destination from user-controlled input. If a dynamic subdomain is required, constrain the value to hostname-safe characters:value: '(?<region>[a-z0-9-]+)'.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Next.js: Unbounded Server Action payload in Edge runtime
CVE-2026-64646 / GHSA-4c39-4ccg-62r3
More information
Details
Impact
Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime
Workarounds
If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
CVE-2026-64647 / GHSA-4633-3j49-mh5q
More information
Details
Impact
A server-side
fetchwith a request body may return a cached response body from a different request to the same URL but different body. Confidential data in thePOST's response body would then leak to unauthorized requests. Though the request itself will not be deduped.This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for
삃삃and섄섄in the request body would share the same cache.Workarounds
If you cannot upgrade, consider only making fetch requests with UTF-8 bodies (default in Next.js). Applications using Pages Router are not vulnerable.
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Next.js: Cache confusion of response bodies for requests with bodies
CVE-2026-64648 / GHSA-68g3-v927-f742
More information
Details
Impact
A server-side
fetchwith a request body may return a cached response body from a different request to the same URL but different body. Confidential data in thePOST's response body would then leak to unauthorized requests. Though the request itself will not be deduped.This only applies to
fetchcalls with a request that has a different init than the one passed tofetch.Safe:
fetch(new Request(init), init)Unsafe:
fetch(new Request(init), aDifferentInit)Workarounds
No workaround exists besides upgrading. Applications using Pages Router are not vulnerable.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Next.js: Server-Side Request Forgery in Server Actions on custom servers
CVE-2026-64649 / GHSA-89xv-2m56-2m9x
More information
Details
Impact
When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.
Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected;
next startand standalone output do the same from version 14.2 onward.Workarounds
If you cannot upgrade, ensure clients do not control the host header your application receives. Pin or validate
HostandX-Forwarded-Hostat your edge or proxy. On version 14.2.0 and later, you can additionally set the__NEXT_PRIVATE_ORIGINenvironment variable to your deployment's real origin: