The Next.js team has disclosed nine security vulnerabilities, all patched in 15.5.21 and 16.2.11. The issues span server-side request forgery (SSRF), a middleware authorization bypass, denial of service (DoS), and cache/identifier disclosure. Here’s what Netlify customers need to know.

Summary

If you run Next.js on Netlify, upgrade next to 15.5.21 or 16.2.11 and redeploy. Netlify-hosted sites are not affected by three of these (Server Action Host forwarding, the Image Optimizer DoS, and the Edge-runtime OOM). The rest affect only apps using a specific pattern or configuration, and are resolved by upgrading — see Impact on Netlify for the per-issue verdict.

Vulnerabilities

All issues are patched in 15.5.21 and 16.2.11. Earlier minors of 15.x and 16.x will not be patched; affected projects must upgrade to a patched minor. Follow the GHSA links for full details.

Vulnerability	Severity	Affected versions
CVE-2026-64645 / GHSA-p9j2-gv94-2wf4 — Server-Side Request Forgery in rewrites via attacker-controlled destination hostname	High	≥12.0.0 <15.5.21, ≥16.0.0 <16.2.11
CVE-2026-64649 / GHSA-89xv-2m56-2m9x — Server-Side Request Forgery in Server Actions on custom servers	High	≥14.1.1 <15.5.21, ≥16.0.0 <16.2.11
CVE-2026-64642 / GHSA-6gpp-xcg3-4w24 — Middleware / Proxy bypass in App Router applications using Turbopack and single locale	High	≥16.0.0 <16.2.11
CVE-2026-64641 / GHSA-m99w-x7hq-7vfj — Denial of Service in App Router using Server Actions	High	≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11
CVE-2026-64644 / GHSA-q8wf-6r8g-63ch — Denial of Service in the Image Optimization API using SVGs	Medium	≥15.5.0 <15.5.21, ≥16.0.0 <16.2.11
CVE-2026-64646 / GHSA-4c39-4ccg-62r3 — Unbounded Server Action payload in Edge runtime	Medium	≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11
CVE-2026-64648 / GHSA-68g3-v927-f742 — Cache confusion of response bodies for requests with bodies	Medium	≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11
CVE-2026-64647 / GHSA-4633-3j49-mh5q — Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences	Medium	≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11
CVE-2026-64643 / GHSA-955p-x3mx-jcvp — Unauthenticated disclosure of internal Server Function endpoints	Medium	≥13.0.0 <15.5.21, ≥16.0.0 <16.2.11

Impact on Netlify

Server-side request forgery

CVE-2026-64645 / GHSA-p9j2-gv94-2wf4 (Server-Side Request Forgery in rewrites via attacker-controlled destination hostname): Netlify sites are affected if a rewrites() or redirects() rule builds the destination hostname from request input (static destinations are not). Upgrading Next.js resolves it.

CVE-2026-64649 / GHSA-89xv-2m56-2m9x (Server-Side Request Forgery in Server Actions on custom servers): Netlify sites are not affected — our edge overwrites inbound X-Forwarded-Host with the real host, so an attacker cannot redirect the Server Action’s outbound request to a host they control.

Middleware authorization bypass

CVE-2026-64642 / GHSA-6gpp-xcg3-4w24 (Middleware / Proxy bypass in App Router applications using Turbopack and single locale): Netlify sites are affected if they build with Turbopack and use the legacy middleware.ts convention with single-locale i18n. Webpack builds and the newer proxy.ts convention are not affected. Upgrading Next.js resolves it.

Denial of service

CVE-2026-64641 / GHSA-m99w-x7hq-7vfj (Denial of Service in App Router using Server Actions) and CVE-2026-64646 / GHSA-4c39-4ccg-62r3 (Unbounded Server Action payload in Edge runtime) are server-side DoS. On Netlify these have minimal impact: our autoscaling architecture means a hung or crashed function does not affect other requests, though active exploitation could increase your function costs. The Edge-runtime OOM specifically cannot exhaust memory on Netlify — request bodies are capped and each request runs in an isolated invocation. Upgrading Next.js resolves both.

CVE-2026-64644 / GHSA-q8wf-6r8g-63ch (Denial of Service in the Image Optimization API using SVGs): Netlify sites are not affected — /_next/image is served by Netlify Image CDN, so the vulnerable Next.js code path is not used.

Cache disclosure / confusion

CVE-2026-64648 / GHSA-68g3-v927-f742 (Cache confusion of response bodies for requests with bodies) and CVE-2026-64647 / GHSA-4633-3j49-mh5q (Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences): Netlify sites are affected if they use the specific cached-fetch patterns — a cached fetch(new Request(url), init), or a cached binary-body POST fetch(). fetch(url, init) and cache: 'no-store' are not affected. Upgrading Next.js resolves both.

Information disclosure

CVE-2026-64643 / GHSA-955p-x3mx-jcvp (Unauthenticated disclosure of internal Server Function endpoints): Netlify sites are affected (low impact) if they use Cache Components with a reflective Server Action co-bundled alongside a use cache function. The leak is limited to opaque internal function identifiers — no credentials or PII. Upgrading Next.js resolves it.

What should I do?

We strongly recommend upgrading as soon as possible:

Upgrade next to 15.5.21 or 16.2.11, then redeploy.

For Next.js 13.x and 14.x: patches target 15.x / 16.x — upgrade to a patched minor.

Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted. Consider deleting these deploys manually.

Security Update: Multiple vulnerabilities in Next.js