next@16.2.10

next is a react framework.

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in createPatchedFetcher in packages/next/src/server/lib/patch-fetch.ts. An attacker can leak a cached response body from one request to another by sending server-side fetch(new Request(...), init) calls to the same URL with different request bodies or overrides. When the Request object and the separate init object diverge, the fetch cache can key the request differently from the effective upstream request, so a response generated for one body is reused for a different body. This exposes confidential data in cached POST responses to unauthorized requests.

Notes

• Applications using the Pages Router are not in scope for this issue; the advisory applies to the server-side patched fetch path.
• The leak requires fetch(new Request(...), init) where the separate init overrides the base Request; fetch(new Request(init), init) is the safe shape called out by the maintainers.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through createForwardedActionResponse and createRedirectRenderResult in packages/next/src/server/app-render/action-handler.ts. An attacker can make the server send a forwarded Server Action request or internal redirect to a malicious host by supplying Host-associated headers on a custom server deployment. The affected code builds the outbound origin from the incoming request’s host value when __NEXT_PRIVATE_ORIGIN is not set, so a crafted request can steer the server into contacting an attacker-controlled URL. In deployments where the host header is not pinned to a trusted origin, this can also expose internal values used in middleware or proxy authorization decisions.

Notes

• Managed hosting that pins the incoming host upstream is not in scope for this issue; the vulnerable path is the custom-server/deployment-with-untrusted-host-header case described in the advisory.
• The __NEXT_PRIVATE_ORIGIN environment variable can override the derived origin in affected versions, so deployments that set it to a fixed real origin avoid the host-header-derived outbound URL.

Workarounds

• Ensure clients cannot control the Host and X-Forwarded-Host headers your application receives by pinning or validating them at your edge or proxy, which prevents attacker-supplied host-associated headers from steering forwarded Server Actions requests or redirects to a malicious host.
• On Next.js 14.2.0 and later, set __NEXT_PRIVATE_ORIGIN to your deployment’s real origin, for example __NEXT_PRIVATE_ORIGIN=https://www.example.com node server.js, which prevents the server from deriving the outbound origin from request headers.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the areAllActionIdsValid validation in server action form submission handling. An attacker can exhaust CPU and block other requests in the same process by sending a crafted form payload with many $ACTION_REF_ fields to a page that uses Server Actions. The vulnerable code processes these malformed MPA form submissions before deeper action decoding work, so repeated oversized action-reference fields force excessive validation work on the server. Applications using the App Router with at least one Server Action are affected; Pages Router apps and apps without Server Actions are not.

Notes

• The vulnerable path is in App Router’s MPA form-submission validation, so the expensive validation work is exercised before action decoding on requests carrying server-action form data rather than during the action handler itself.
• The malformed payload pattern is specific to repeated $ACTION_REF_ fields in the form body; ordinary Server Action submissions are not affected unless they include an unusually large number of those reference fields.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in action-handler.ts and action-utils.ts. An attacker can enumerate internal Server Action IDs by sending crafted Next-Action requests or probing client-served artifacts that reference those IDs. This exposes the presence of internal server functions and enables endpoint discovery on apps that use Server Actions, increasing the risk of further abuse when combined with other weaknesses.

Notes

• Publicly served client artifacts can reveal the full Server Action ID format, so the disclosure is not limited to active probing with Next-Action; attackers can also recover candidate IDs from browser-delivered chunks and manifests in apps that ship Server Actions.
• The advisory also covers use cache endpoints exposed through the same App Router server-function machinery, not just use server actions.

Workarounds

• Never assume authentication at the use cache or use server boundary; authenticate inside the Server Action or cache boundary itself so unauthenticated users cannot reach the internal endpoint.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handleAction Server Actions path in the App Router Edge runtime. An attacker can exhaust server memory by sending an oversized Server Action request, especially a multipart form submission, because the Edge handler reads the full body without enforcing serverActions.bodySizeLimit. This can crash or destabilize affected deployments and prevent legitimate Server Action requests from being processed.

Notes

• Affected deployments need App Router pages with at least one Server Action running in the Edge runtime; the issue is in that execution path rather than in Server Actions generally.
• The advisory’s practical ceiling is tied to hosting-side request body limits: if the platform does not cap uploads, an oversized multipart action request can still drive memory growth before application code sees it.

Workarounds

• Limit Server Actions request bodies at your hosting provider to 5 MiB maximum, so oversized multipart submissions cannot reach the Edge runtime and trigger excessive memory use.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the detectContentType path in next/dist/server/image-optimizer. An attacker can exhaust CPU in /_next/image by sending a remotely hosted SVG that forces expensive content-type detection during image optimization. The vulnerable code runs when the default image loader optimizes configured remote images, so a malicious SVG in config.images.remotePatterns can make the Image Optimization API spend excessive time parsing the response before serving it. This degrades or stalls image requests for users of self-hosted Next.js deployments that rely on the default optimizer.

Notes

• Self-hosted deployments only: the expensive path is in the default Image Optimization API, so config.images.loader: 'custom', config.images.unoptimized: true, and Vercel-hosted apps are outside the vulnerable deployment pattern.
• The affected remote-image surface is limited to the patterns listed in config.images.remotePatterns; only those configured origins can drive the costly SVG content-type detection work.

Workarounds

• Set config.experimental.imgOptSkipMetadata: true to avoid the expensive metadata-detection path in /_next/image, which mitigates the CPU-exhaustion attack from malicious remote SVGs.

Upgrade next to version 15.5.21, 16.2.11 or higher.