CVE-2026-64643 - Next.js: Unauthenticated Disclosure of Internal Server Function endpoints

Back Back to CVE browser

MEDIUM

Next.js: Unauthenticated Disclosure of Internal Server Function endpoints

Published Jul 27, 2026

6.3

MEDIUM

CVSS 4.0

EPSS 0.51%

Description

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11.

Affected products

Vendor Vercel Product Next.js Default
n/a
- Version
  >= 13.0.0, < 15.5.21
  Status
  affected
  Constraints
  -
- Version
  >= 16.0.0, < 16.2.11
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Vercel

Next.js

n/a

Version	Status	Constraints
>= 13.0.0, < 15.5.21	affected	-
>= 16.0.0, < 16.2.11	affected	-

Red Hat Enterprise Linux 10

firefox

Fix deferred
Red Hat Enterprise Linux 10

thunderbird

Fix deferred
Red Hat Enterprise Linux 7

firefox

Fix deferred
Red Hat Enterprise Linux 8

firefox

Fix deferred
Red Hat Enterprise Linux 8

thunderbird

Fix deferred
Red Hat Enterprise Linux 9

firefox

Fix deferred
Red Hat Enterprise Linux 9

thunderbird

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-cuda-rhel9

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-gaudi-rhel9

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/bootc-rocm-rhel9

Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3

rhelai3/disk-image-cuda-rhel9

Fix deferred
Red Hat Trusted Artifact Signer

rhtas/rekor-search-ui-rhel9

Fix deferred
streams for Apache Kafka 2

next

Out of support scope
streams for Apache Kafka 3

next

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 10	thunderbird	Fix deferred	n/a
Red Hat Enterprise Linux 7	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 8	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 8	thunderbird	Fix deferred	n/a
Red Hat Enterprise Linux 9	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 9	thunderbird	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-cuda-rhel9	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-gaudi-rhel9	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/bootc-rocm-rhel9	Fix deferred	n/a
Red Hat Enterprise Linux AI (RHEL AI) 3	rhelai3/disk-image-cuda-rhel9	Fix deferred	n/a
Red Hat Trusted Artifact Signer	rhtas/rekor-search-ui-rhel9	Fix deferred	n/a
streams for Apache Kafka 2	next	Out of support scope	n/a
streams for Apache Kafka 3	next	Fix deferred	n/a

Ecosystem	Package	Introduced	Fixed
npm	next	13.0.0	15.5.21
npm	next	16.0.0	16.2.11

Remediation

Red Hat statement

This Moderate information disclosure vulnerability in Next.js applications allows unauthenticated users to obtain Server Action IDs from publicly served client artifacts. While primarily a reconnaissance primitive, this exposure could increase overall risk when chained with other weaknesses. Red Hat products and services that incorporate Next.js, such as Red Hat AMQ, Red Hat Enterprise Linux AI, and cloud.redhat.com offerings, are affected.

Weaknesses (1)

CWE-201

References (10)

https://access.redhat.com/security/cve/CVE-2026-64643
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2507626
Issue Tracking
https://github.com/advisories/GHSA-955p-x3mx-jcvp
Advisory
https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3
x_refsource_MISCPatch
https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b
x_refsource_MISCPatch
https://github.com/vercel/next.js/releases/tag/v15.5.21
x_refsource_MISCProductRelease Notes
https://github.com/vercel/next.js/releases/tag/v16.2.11
x_refsource_MISCProductRelease Notes
https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-64643
https://www.cve.org/CVERecord?id=CVE-2026-64643

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-64643		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2507626		Issue Tracking
https://github.com/advisories/GHSA-955p-x3mx-jcvp		Advisory
https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3		x_refsource_MISCPatch
https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b		x_refsource_MISCPatch
https://github.com/vercel/next.js/releases/tag/v15.5.21		x_refsource_MISCProductRelease Notes
https://github.com/vercel/next.js/releases/tag/v16.2.11		x_refsource_MISCProductRelease Notes
https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-64643
https://www.cve.org/CVERecord?id=CVE-2026-64643