Vercel has released emergency security updates for Next.js, addressing nine vulnerabilities that could expose applications to server-side request forgery (SSRF), authentication bypass, denial-of-service (DoS), cache confusion, and sensitive information disclosure. The flaws, discovered by security researcher, affect multiple versions of the widely used React framework and have been fixed in Next.js 15.5.21 and 16.2.11. The coordinated release also marks the start of Next.js' new monthly security update program, reflecting an increased focus on proactive vulnerability management.

The most severe issues are two high-severity SSRF vulnerabilities. CVE-2026-64645 allows attackers to manipulate the rewrites() or redirects() functionality by supplying a malicious destination hostname, potentially forcing the server to send requests to internal or otherwise restricted systems. CVE-2026-64649 similarly affects Server Actions on custom Node.js servers, enabling attackers to redirect outbound server requests to attacker-controlled infrastructure. In addition, CVE-2026-64642 can bypass middleware-based authentication in App Router applications using Turbopack, legacy middleware.ts, and single-locale i18n configurations, while CVE-2026-64641 enables attackers to trigger denial-of-service conditions through specially crafted Server Actions requests.

Beyond the high-severity flaws, Vercel also patched several moderate-severity vulnerabilities affecting application stability and data integrity. CVE-2026-64646 allows unbounded Server Action payloads in the Edge runtime to consume excessive memory, while CVE-2026-64644 can crash the Image Optimization API using malicious SVG files. Two cache confusion vulnerabilities, CVE-2026-64648 and CVE-2026-64647, may cause cached responses to be incorrectly shared between users under specific caching conditions, creating a risk of unintended data exposure. Another issue, CVE-2026-64643, leaks internal Server Function endpoint identifiers when Cache Components are combined with reflective Server Actions, exposing implementation details even though no credentials or personal data are directly disclosed.

The vulnerabilities affect a broad range of Next.js releases, with some flaws impacting versions as early as 12.0.0. Notably, Next.js 13.x and 14.x will not receive security patches, requiring organizations to upgrade to the supported 15.5.21 or 16.2.11 releases to remain protected. Security teams should also review application configurations involving rewrites, redirects, custom Node.js servers, Turbopack middleware, Server Actions, Cache Components, and fetch() caching behavior to identify potential exposure. Given the widespread adoption of Next.js in production environments, prompt patching and configuration reviews are essential to reduce the risk of SSRF attacks, authorization bypass, service disruption, and unintended data leakage.