vercel next.js up to 16.1.6 /_next/webpack-hmr missing origin validation in websockets

Summaryinfo

A vulnerability categorized as problematic has been discovered in vercel next.js up to 16.1.6. This affects an unknown function of the file /_next/webpack-hmr. Executing a manipulation can lead to missing origin validation in websockets. This vulnerability is handled as CVE-2026-27977. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in vercel next.js up to 16.1.6 and classified as problematic. This vulnerability affects an unknown functionality of the file /_next/webpack-hmr. The manipulation with an unknown input leads to a missing origin validation in websockets vulnerability. The CWE definition for the vulnerability is CWE-1385. The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid. As an impact it is known to affect confidentiality, and integrity. CVE summarizes:

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured `allowedDevOrigins` still allow connections from any origin. The issue is fixed in version 16.1.7 by validating `Origin: null` through the same cross-site origin-allowance checks used for other origins. If upgrading is not immediately possible, do not expose `next dev` to untrusted networks and/or block websocket upgrades to `/_next/webpack-hmr` when `Origin` is `null` at the proxy.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-27977 since 02/25/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 303199 (Next.js Framework 16.0.1 < 16.1.7 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 16.1.7 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 862f9b9bb41d235e0d8cf44aa811e7fd118cee2a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (303199). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• JavaScript Library

Vendor

• vercel

Name

• next.js

Version

• 16.1.0
• 16.1.1
• 16.1.2
• 16.1.3
• 16.1.4
• 16.1.5
• 16.1.6

License

• open-source

Website

• Product: https://github.com/vercel/next.js/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion