---
title: "Next.js security release (July 2026): what to know"
description: "Nine Next.js vulnerabilities disclosed: SSRF, middleware auth bypass, DoS, and cache issues. Affected projects should upgrade to 15.5.21 or 16.2.11."
source: "https://www.netlify.com/changelog/2026-07-21-nextjs-security-vulnerabilities/"
last_updated: "2026-07-22T14:25:31.000Z"
---
The Next.js team has disclosed [nine security vulnerabilities](https://github.com/vercel/next.js/security), all patched in **15.5.21** and **16.2.11**. The issues span server-side request forgery (SSRF), a middleware authorization bypass, denial of service (DoS), and cache/identifier disclosure. Here’s what Netlify customers need to know.

## Summary

If you run Next.js on Netlify, **upgrade `next` to 15.5.21 or 16.2.11** and redeploy. Netlify-hosted sites are **not affected** by three of these (Server Action `Host` forwarding, the Image Optimizer DoS, and the Edge-runtime OOM). The rest affect only apps using a specific pattern or configuration, and are resolved by upgrading — see [Impact on Netlify](#impact-on-netlify) for the per-issue verdict.

## Vulnerabilities

All issues are patched in **15.5.21** and **16.2.11**. Earlier minors of 15.x and 16.x will not be patched; affected projects must upgrade to a patched minor. Follow the GHSA links for full details.

Vulnerability

Severity

Affected versions

[CVE-2026-64645](https://www.cve.org/CVERecord?id=CVE-2026-64645) / [GHSA-p9j2-gv94-2wf4](https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4) — Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

High

≥12.0.0 <15.5.21, ≥16.0.0 <16.2.11

[CVE-2026-64649](https://www.cve.org/CVERecord?id=CVE-2026-64649) / [GHSA-89xv-2m56-2m9x](https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x) — Server-Side Request Forgery in Server Actions on custom servers

High

≥14.1.1 <15.5.21, ≥16.0.0 <16.2.11

[CVE-2026-64642](https://www.cve.org/CVERecord?id=CVE-2026-64642) / [GHSA-6gpp-xcg3-4w24](https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24) — Middleware / Proxy bypass in App Router applications using Turbopack and single locale

High

≥16.0.0 <16.2.11

[CVE-2026-64641](https://www.cve.org/CVERecord?id=CVE-2026-64641) / [GHSA-m99w-x7hq-7vfj](https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj) — Denial of Service in App Router using Server Actions

High

≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11

[CVE-2026-64644](https://www.cve.org/CVERecord?id=CVE-2026-64644) / [GHSA-q8wf-6r8g-63ch](https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch) — Denial of Service in the Image Optimization API using SVGs

Medium

≥15.5.0 <15.5.21, ≥16.0.0 <16.2.11

[CVE-2026-64646](https://www.cve.org/CVERecord?id=CVE-2026-64646) / [GHSA-4c39-4ccg-62r3](https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3) — Unbounded Server Action payload in Edge runtime

Medium

≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11

[CVE-2026-64648](https://www.cve.org/CVERecord?id=CVE-2026-64648) / [GHSA-68g3-v927-f742](https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742) — Cache confusion of response bodies for requests with bodies

Medium

≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11

[CVE-2026-64647](https://www.cve.org/CVERecord?id=CVE-2026-64647) / [GHSA-4633-3j49-mh5q](https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q) — Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Medium

≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11

[CVE-2026-64643](https://www.cve.org/CVERecord?id=CVE-2026-64643) / [GHSA-955p-x3mx-jcvp](https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp) — Unauthenticated disclosure of internal Server Function endpoints

Medium

≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11

## Impact on Netlify

### Server-side request forgery

[CVE-2026-64645](https://www.cve.org/CVERecord?id=CVE-2026-64645) / [GHSA-p9j2-gv94-2wf4](https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4) (Server-Side Request Forgery in rewrites via attacker-controlled destination hostname): Netlify sites are **affected** if a `rewrites()` or `redirects()` rule builds the destination hostname from request input (static destinations are not). Upgrading Next.js resolves it.

[CVE-2026-64649](https://www.cve.org/CVERecord?id=CVE-2026-64649) / [GHSA-89xv-2m56-2m9x](https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x) (Server-Side Request Forgery in Server Actions on custom servers): Netlify sites are **not affected** — our edge overwrites inbound `X-Forwarded-Host` with the real host, so an attacker cannot redirect the Server Action’s outbound request to a host they control.

### Middleware authorization bypass

[CVE-2026-64642](https://www.cve.org/CVERecord?id=CVE-2026-64642) / [GHSA-6gpp-xcg3-4w24](https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24) (Middleware / Proxy bypass in App Router applications using Turbopack and single locale): Netlify sites are **affected** if they build with Turbopack and use the legacy `middleware.ts` convention with single-locale i18n. Webpack builds and the newer `proxy.ts` convention are not affected. Upgrading Next.js resolves it.

### Denial of service

[CVE-2026-64641](https://www.cve.org/CVERecord?id=CVE-2026-64641) / [GHSA-m99w-x7hq-7vfj](https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj) (Denial of Service in App Router using Server Actions) and [CVE-2026-64646](https://www.cve.org/CVERecord?id=CVE-2026-64646) / [GHSA-4c39-4ccg-62r3](https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3) (Unbounded Server Action payload in Edge runtime) are server-side DoS. On Netlify these have **minimal impact**: our autoscaling architecture means a hung or crashed function does not affect other requests, though active exploitation could increase your function costs. The Edge-runtime OOM specifically **cannot exhaust memory on Netlify** — request bodies are capped and each request runs in an isolated invocation. Upgrading Next.js resolves both.

[CVE-2026-64644](https://www.cve.org/CVERecord?id=CVE-2026-64644) / [GHSA-q8wf-6r8g-63ch](https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch) (Denial of Service in the Image Optimization API using SVGs): Netlify sites are **not affected** — `/_next/image` is served by [Netlify Image CDN](https://docs.netlify.com/build/image-cdn/overview/), so the vulnerable Next.js code path is not used.

### Cache disclosure / confusion

[CVE-2026-64648](https://www.cve.org/CVERecord?id=CVE-2026-64648) / [GHSA-68g3-v927-f742](https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742) (Cache confusion of response bodies for requests with bodies) and [CVE-2026-64647](https://www.cve.org/CVERecord?id=CVE-2026-64647) / [GHSA-4633-3j49-mh5q](https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q) (Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences): Netlify sites are **affected** if they use the specific cached-fetch patterns — a cached `fetch(new Request(url), init)`, or a cached binary-body POST `fetch()`. `fetch(url, init)` and `cache: 'no-store'` are not affected. Upgrading Next.js resolves both.

### Information disclosure

[CVE-2026-64643](https://www.cve.org/CVERecord?id=CVE-2026-64643) / [GHSA-955p-x3mx-jcvp](https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp) (Unauthenticated disclosure of internal Server Function endpoints): Netlify sites are **affected** (low impact) if they use Cache Components with a reflective Server Action co-bundled alongside a `use cache` function. The leak is limited to opaque internal function identifiers — no credentials or PII. Upgrading Next.js resolves it.

## What should I do?

We strongly recommend upgrading as soon as possible:

-   Upgrade `next` to **15.5.21** or **16.2.11**, then redeploy.

For Next.js 13.x and 14.x: patches target 15.x / 16.x — upgrade to a patched minor.

Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are [automatically deleted](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#automatic-deploy-deletion). Consider [deleting these deploys manually](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#manual-deploy-deletion-through-the-netlify-ui).

## Resources

-   [Next.js July 2026 security release](https://nextjs.org/blog/july-2026-security-release)
-   [Next.js security advisories](https://github.com/vercel/next.js/security)