July 2026 Security Release

Andrew Imm,

Josh Story,

Sebastian Silbermann

Last week we announced that Next.js would be moving to a preannounced security release model, with patches announced ahead of time so that teams can plan for them.

Updates are now available in v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS) to address these issues. Please patch your Next.js dependencies to maintain the security of your applications.

npm install [email protected]  # for 15.5
npm install [email protected]  # for 16.2

These fixes are also available in the latest Next.js 16.3 canary (

v16.3.0-canary.92

) and preview (

v16.3.0-preview.7

) releases, and will be included in

v16.3.0

once it reaches a stable release.

npm install [email protected]   # canary
npm install [email protected]   # preview

Copy link to headingImpact

Copy link to headingDenial of Service in App Router using Server Actions (High Severity)

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage. The CPU usage blocks processing of further requests in the same process, leading to Denial of Service.

Copy link to headingMiddleware / Proxy bypass in App Router applications using Turbopack and single locale (High Severity)

Next.js applications using App Router built with Turbopack and a single entry in

config.i18n.locales

are vulnerable to a middleware/proxy bypass. Accordingly, any authentication or security checks that a middleware/proxy may perform are bypassed.

Copy link to headingServer-Side Request Forgery in rewrites via attacker-controlled destination hostname (High Severity)

A

rewrites()

or

redirects()

rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For rewrites, this behavior enables Server-Side Request Forgery (SSRF); for redirects, Open Redirect can be achieved.

Copy link to headingServer-Side Request Forgery in Server Actions on custom servers (High Severity)

When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker’s request to control Host-associated headers.

Copy link to headingDenial of Service in the Image Optimization API using SVGs (Medium Severity)

When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, the images can cause CPU exhaustion in the

/_next/image

endpoint.

Copy link to headingUnbounded Server Action payload in Edge runtime (Medium Severity)

A crafted request can lead to memory consumption on Server Actions in the Edge runtime. Next.js applications which use App Router and have at least one Server Action are affected.

Copy link to headingUnauthenticated disclosure of internal Server Function endpoints (Medium Severity)

In Next.js applications using App Router, Server Actions (use server) or use cache endpoint IDs can be globally disclosed. An attacker can use this for reconnaissance and as part of a broader attack chain.

Copy link to headingCache confusion of response bodies for requests with bodies (Medium Severity)

A server-side

fetch

with a request body may return a cached response body from a different request to the same URL but different body. This only applies for

fetch

calls of the following shape:

fetch(new Request(init), aDifferentInit)

Copy link to headingCache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences (Medium Severity)

A server-side

fetch

with a request body may return a cached response body from a different request to the same URL but different body. This only applies when receiving request bodies which contain invalid UTF-8 characters. For example, the UTF-16 byte sequences for

삃삃

and

섄섄

in the request body would share the same cache.

Copy link to headingOur security program

We work with a talented set of researchers to secure Next.js and other open source frameworks through Vercel's Open Source Bug Bounty. Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or vulnerability management can be sent to [email protected].