CVE-2026-64643 in Next.js
Summary
by MITRE • 07/27/2026
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/27/2026
This vulnerability affects Next.js applications utilizing the App Router with Server Actions or use cache endpoints, creating a critical information disclosure flaw that undermines authentication mechanisms. The vulnerability stems from improper handling of server action identifiers within client-side artifacts, specifically static chunks that contain references to server actions. These artifacts are served publicly without adequate access controls, allowing unauthenticated users to discover server action IDs through client-side code analysis. This represents a classic case of insufficient authorization checks where sensitive backend metadata leaks into frontend deliverables, enabling attackers to enumerate available server endpoints and potentially exploit them.
The technical flaw manifests in how Next.js serializes and exposes server action identifiers during the build process. When applications utilize App Router with Server Actions, the framework generates client-side code containing references to server endpoints that should remain protected. These references are embedded within static chunks and other client artifacts that are served publicly to all users regardless of authentication status. The vulnerability affects versions from 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, indicating a widespread issue across multiple major releases. This pattern aligns with CWE-200 (Information Disclosure) and represents a privilege escalation vector that can be leveraged for reconnaissance purposes.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with actionable intelligence for potential exploitation. While the disclosure itself may appear benign as a reconnaissance primitive, it significantly increases attack surface by revealing backend endpoint structures that could be combined with other vulnerabilities. Attackers can use discovered server action IDs to craft targeted requests or identify potential injection points within server-side code. The vulnerability particularly affects applications using App Router and Server Actions because these features introduce additional layers of complexity in the application architecture where traditional access controls may not adequately protect serialized identifiers. This issue demonstrates how modern web frameworks' advanced features can inadvertently create security gaps when proper segregation between client and server concerns is not maintained.
The fix implemented in versions 15.5.21 and 16.2.11 addresses this vulnerability by ensuring that server action identifiers are properly sanitized or removed from publicly served client artifacts. This remediation aligns with security best practices for protecting sensitive metadata in web applications and reflects the principle of least privilege where only authorized users should have access to backend endpoint information. Organizations should prioritize upgrading their Next.js applications to these patched versions while also implementing additional monitoring for unusual patterns in server action requests. The vulnerability serves as a reminder of the importance of comprehensive security testing during framework upgrades and highlights the need for careful consideration of how modern web application features interact with traditional access control mechanisms.
This vulnerability relates to several ATT&CK techniques including T1595 (Active Scanning) through reconnaissance activities, T1071.004 (Application Layer Protocol: DNS) if attackers use discovered endpoints for further enumeration, and T1213.002 (Data from Information Repositories: Source Code) when server action IDs are used to understand application structure. The issue also connects to the broader security principle of protecting sensitive information in client-side code, which is fundamental to preventing unauthorized access to backend systems through frontend vulnerabilities that serve as entry points for more sophisticated attacks.