Vercel has disclosed and fixed nine security vulnerabilities affecting Next.js, one of the most widely deployed React frameworks for building web applications. The advisories, credited to security researcher KarimPwnz, were published together and are addressed in Next.js versions 15.5.21 and 16.2.11. The batch release also marks the debut of a new monthly security release cadence the Next.js team recently announced, bundling multiple fixes into a single coordinated update rather than trickling them out individually.

The Most Serious Issue: SSRF via Rewrites

The highest-priority flaw, tracked as CVE-2026-64645, is a high-severity server-side request forgery vulnerability in the framework’s rewrites feature. When a rewrites() or redirects() rule constructs its destination hostname using attacker-controlled request data, an attacker can force the server to send requests to internal endpoints that should never be reachable from the outside. This issue affects a broad swath of the ecosystem, spanning Next.js 12.0.0 through 15.5.21 and 16.0.0 through 16.2.11.

A related SSRF bug, CVE-2026-64649, hits Server Actions running on custom Node.js servers, letting attackers redirect outbound Server Action requests toward infrastructure they control. Together, these two SSRF issues give attackers a path to probe or interact with internal systems that are normally shielded behind the application server.

Authentication Bypass and Denial-of-Service Bugs

Perhaps the most operationally dangerous flaw for production applications is CVE-2026-64642, which enables a middleware and proxy bypass in App Router applications built with Turbopack and configured with legacy middleware.ts alongside single-locale internationalization settings. In vulnerable configurations, this bypass can let attackers skip authorization checks entirely — a serious concern for any app that relies on middleware to gate access to protected routes.

Rounding out the high-severity list, CVE-2026-64641 allows attackers to trigger denial-of-service conditions in App Router applications through maliciously crafted Server Actions requests. Two additional moderate-severity DoS issues were also patched: CVE-2026-64646, involving unbounded Server Action payloads in the Edge runtime that can exhaust available memory, and CVE-2026-64644, which lets an attacker crash the Image Optimization API by submitting a specially crafted malicious SVG file.

Cache Confusion and Data Exposure

Two moderate-severity bugs, CVE-2026-64648 and CVE-2026-64647, involve cache confusion that can cause one user’s response body to be served to a different user under certain caching configurations — specifically when applications use cached fetch() calls with request bodies, including those containing invalid UTF-8 byte sequences. This class of bug is especially concerning for multi-tenant applications, where mixing up responses between users could expose one customer’s data to another.

A final moderate-severity issue, CVE-2026-64643, exposes internal Server Function endpoint identifiers to unauthenticated attackers when Cache Components are used together with reflective Server Actions. Vercel notes this leak is limited to opaque identifiers rather than credentials or personal data, somewhat limiting its real-world impact compared to the other issues in this batch.

Summary of the Nine Vulnerabilities

• CVE-2026-64645 — SSRF in rewrites (High)
• CVE-2026-64649 — SSRF in Server Actions on custom servers (High)
• CVE-2026-64642 — Middleware/proxy authorization bypass (High)
• CVE-2026-64641 — DoS via Server Actions (High)
• CVE-2026-64646 — Unbounded Edge runtime payload (Moderate)
• CVE-2026-64644 — Image Optimization API DoS via SVG (Moderate)
• CVE-2026-64648 — Cache confusion, response bodies (Moderate)
• CVE-2026-64647 — Cache confusion, invalid UTF-8 (Moderate)
• CVE-2026-64643 — Server Function endpoint identifier disclosure (Moderate)

Who Needs to Act, and How

The affected version ranges stretch back years — as early as Next.js 12.0.0 for the rewrites SSRF bug and 13.0.0 for several of the DoS and cache-related issues. Notably, older major versions such as 13.x and 14.x will not receive direct backported patches, meaning teams still running those branches must upgrade to a fixed 15.x or 16.x release to close these gaps rather than waiting for a point patch on their current version.

Security and platform teams should treat this as a priority upgrade rather than routine maintenance. Recommended steps include upgrading to Next.js 15.5.21 or 16.2.11 as soon as possible, then auditing application configurations for use of rewrites, custom Node.js servers, Turbopack-based middleware, and Cache Components to determine which specific vulnerabilities apply to a given deployment. Given how many production applications run on Next.js, and the mix of SSRF, authorization bypass, and DoS issues in this release, the update deserves the same urgency typically reserved for critical infrastructure patches.