next@14.3.0-canary.14

next is a react framework.

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in createPatchedFetcher in packages/next/src/server/lib/patch-fetch.ts. An attacker can leak a cached response body from one request to another by sending server-side fetch(new Request(...), init) calls to the same URL with different request bodies or overrides. When the Request object and the separate init object diverge, the fetch cache can key the request differently from the effective upstream request, so a response generated for one body is reused for a different body. This exposes confidential data in cached POST responses to unauthorized requests.

Notes

• Applications using the Pages Router are not in scope for this issue; the advisory applies to the server-side patched fetch path.
• The leak requires fetch(new Request(...), init) where the separate init overrides the base Request; fetch(new Request(init), init) is the safe shape called out by the maintainers.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through createForwardedActionResponse and createRedirectRenderResult in packages/next/src/server/app-render/action-handler.ts. An attacker can make the server send a forwarded Server Action request or internal redirect to a malicious host by supplying Host-associated headers on a custom server deployment. The affected code builds the outbound origin from the incoming request’s host value when __NEXT_PRIVATE_ORIGIN is not set, so a crafted request can steer the server into contacting an attacker-controlled URL. In deployments where the host header is not pinned to a trusted origin, this can also expose internal values used in middleware or proxy authorization decisions.

Notes

• Managed hosting that pins the incoming host upstream is not in scope for this issue; the vulnerable path is the custom-server/deployment-with-untrusted-host-header case described in the advisory.
• The __NEXT_PRIVATE_ORIGIN environment variable can override the derived origin in affected versions, so deployments that set it to a fixed real origin avoid the host-header-derived outbound URL.

Workarounds

• Ensure clients cannot control the Host and X-Forwarded-Host headers your application receives by pinning or validating them at your edge or proxy, which prevents attacker-supplied host-associated headers from steering forwarded Server Actions requests or redirects to a malicious host.
• On Next.js 14.2.0 and later, set __NEXT_PRIVATE_ORIGIN to your deployment’s real origin, for example __NEXT_PRIVATE_ORIGIN=https://www.example.com node server.js, which prevents the server from deriving the outbound origin from request headers.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the areAllActionIdsValid validation in server action form submission handling. An attacker can exhaust CPU and block other requests in the same process by sending a crafted form payload with many $ACTION_REF_ fields to a page that uses Server Actions. The vulnerable code processes these malformed MPA form submissions before deeper action decoding work, so repeated oversized action-reference fields force excessive validation work on the server. Applications using the App Router with at least one Server Action are affected; Pages Router apps and apps without Server Actions are not.

Notes

• The vulnerable path is in App Router’s MPA form-submission validation, so the expensive validation work is exercised before action decoding on requests carrying server-action form data rather than during the action handler itself.
• The malformed payload pattern is specific to repeated $ACTION_REF_ fields in the form body; ordinary Server Action submissions are not affected unless they include an unusually large number of those reference fields.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in action-handler.ts and action-utils.ts. An attacker can enumerate internal Server Action IDs by sending crafted Next-Action requests or probing client-served artifacts that reference those IDs. This exposes the presence of internal server functions and enables endpoint discovery on apps that use Server Actions, increasing the risk of further abuse when combined with other weaknesses.

Notes

• Publicly served client artifacts can reveal the full Server Action ID format, so the disclosure is not limited to active probing with Next-Action; attackers can also recover candidate IDs from browser-delivered chunks and manifests in apps that ship Server Actions.
• The advisory also covers use cache endpoints exposed through the same App Router server-function machinery, not just use server actions.

Workarounds

• Never assume authentication at the use cache or use server boundary; authenticate inside the Server Action or cache boundary itself so unauthenticated users cannot reach the internal endpoint.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handleAction Server Actions path in the App Router Edge runtime. An attacker can exhaust server memory by sending an oversized Server Action request, especially a multipart form submission, because the Edge handler reads the full body without enforcing serverActions.bodySizeLimit. This can crash or destabilize affected deployments and prevent legitimate Server Action requests from being processed.

Notes

• Affected deployments need App Router pages with at least one Server Action running in the Edge runtime; the issue is in that execution path rather than in Server Actions generally.
• The advisory’s practical ceiling is tied to hosting-side request body limits: if the platform does not cap uploads, an oversized multipart action request can still drive memory growth before application code sees it.

Workarounds

• Limit Server Actions request bodies at your hosting provider to 5 MiB maximum, so oversized multipart submissions cannot reach the Edge runtime and trigger excessive memory use.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the IncrementalCache.generateCacheKey function in next/dist/server/lib/incremental-cache. An attacker can make a server-side fetch return a cached response body from a different request by sending POST requests to the same URL with different non-UTF-8 request bodies that collapse to the same cache key. The affected cache key generation decodes request bodies as strings, so distinct byte sequences with invalid UTF-8 can hash to the same entry even though the requests are not deduped. This can leak confidential response data from one POST to an unauthorized request that uses a colliding body, breaking response isolation for server-side cached fetches.

Notes

• Applications using Pages Router are not affected; the advisory’s cache-key confusion is in the server-side fetch cache path used by the App Router/IncrementalCache flow.
• The issue is only reachable when request bodies are sent with a non-UTF-8 charset or otherwise contain byte sequences that do not round-trip as UTF-8; default UTF-8 request bodies do not trigger the collision described in the advisory.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the CSP nonce headers. An attacker can inject malicious scripts into cached HTML responses by supplying malformed nonce values, which may then be executed in the browsers of subsequent visitors. This is possible when applications are deployed behind shared caches and rely on request-derived nonce values.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Incorrect Authorization in the /_next/data/<buildId>/<page>.json route when i18n is configured and authorization is enforced via middleware or proxy. An attacker can gain unauthorized access to sensitive server-side-rendered JSON data for protected pages by making locale-less requests that bypass the intended authorization checks.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via crafted WebSocket upgrade requests. An attacker can access internal or external resources by sending specially crafted requests with absolute-url that cause the server to proxy connections to arbitrary destinations, potentially exposing sensitive internal services or cloud metadata endpoints.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the beforeInteractive process, when untrusted input is embedded without proper escaping. An attacker can execute arbitrary JavaScript in a user's browser by injecting malicious content into the serialized script.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Image Optimization API when handling requests to the /_next/image endpoint that match the images.localPatterns configuration. An attacker can exhaust server memory and cause a denial of service by requesting large local assets, leading to out-of-memory conditions.

Note: This is only exploitable if the default image loader is used and the images.localPatterns configuration allows access to large local files.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Use of Weak Hash via collisions in the _rsc cache-busting process. An attacker can manipulate cache entries by crafting requests that cause shared caches to serve incorrect response variants to users. This is only exploitable if deployments rely on shared caches with insufficient response partitioning.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Interpretation Conflict via improper handling of shared cache entries for React Server Component responses. An attacker can cause unintended component payloads to be served to other users by manipulating shared cache behavior through crafted requests.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Acceptance of Extraneous Untrusted Data With Trusted Data through the improper handling of the x-nextjs-data header in middleware or proxy redirect responses. An attacker can disrupt access to redirect paths by injecting this header in requests, causing the middleware to generate a redirect response lacking a standard Location header. If a CDN or reverse proxy caches this malformed response without varying on the injected header, subsequent users may receive unusable redirects, resulting in service disruption until the cache is cleared.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via server function endpoints. An attacker can cause out-of-memory exceptions or induce excessive CPU usage by sending malicious FormData in an HTTP request.

Note: Only React apps that use React Server Components are vulnerable.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the createMap, createSet, and extractIterator functions in packages/react-server/src/ReactFlightReplyServer.js. An attacker can crash the server by supplying a model that contains cyclic reference and is consumed more than once during React Server Components decoding. The repeated consumption triggers an exception during reply processing, breaking rendering for requests that handle attacker-controlled Flight payloads.

Upgrade next to version 15.5.15, 16.2.3 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the decoding reply functions of React Flight protocol. An attacker can cause server crashes, out-of-memory exceptions, or excessive CPU usage by sending specially crafted HTTP requests to Server Function endpoints.

Notes:

• This issue is a result of an incomplete fix for CVE-2025-55184
• If your app’s React code does not use a server, your app is not affected by these vulnerabilities.
• If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by these vulnerabilities.

Upgrade next to version 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5, 16.2.0-canary.9 or higher.

next is a react framework.

Affected versions of this package are vulnerable to HTTP Request Smuggling during the rewrite of the proxy traffic to an external backend. An attacker can access unintended backend routes by sending crafted DELETE or OPTIONS requests with Transfer-Encoding: chunked headers. This is only exploitable if the application is not hosted on providers that handle rewrites at the CDN level.

Upgrade next to version 15.5.13, 16.1.7, 16.2.0-canary.102 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of an upper bound on the disk cache used by the image optimization. An attacker can exhaust disk storage by generating a large number of unique image optimization variants, leading to service disruption.

Upgrade next to version 16.1.7, 16.2.0-canary.54 or higher.