Next.js Patches 9 CVEs in v16.2.11 and v15.5.21

Next.js shipped its first scheduled security release on July 20, 2026, patching 9 vulnerabilities — 4 high severity, 5 medium — across the v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS) branches. The fixes are also in the v16.3.0-canary.92 and v16.3.0-preview.7 pre-releases and will land in v16.3.0 when it goes stable.

This is the follow-up Vercel promised in its July 13 announcement of a monthly security release program: name the severity and date up front, publish the CVE detail only once the patch itself ships. That detail is now public, credited to Andrew Imm, Josh Story and Sebastian Silbermann.

The four high-severity fixes

CVE-2026-64641 — Server Actions denial of service. A crafted request to an App Router application with at least one Server Action can drive excessive CPU usage, blocking further requests in the same process.

CVE-2026-64642 — Turbopack middleware/proxy bypass. Apps built with Turbopack that define exactly one entry in config.i18n.locales can have middleware or proxy checks — including authentication — skipped entirely.

CVE-2026-64645 — SSRF via rewrites()/redirects(). If a rewrite or redirect rule builds its external destination hostname from request-controlled input, an attacker can point it at an arbitrary host regardless of the rule's configured hostname suffix. On a redirects() rule the same flaw produces an open redirect instead.

CVE-2026-64649 — SSRF in Server Actions on custom servers. When a Server Action forwards or redirects a request and an attacker controls Host-associated headers, the server can be made to send an outbound request to a host of the attacker's choosing.

Both SSRF bugs matter more than their CVSS-adjacent label suggests in most production stacks: they let an external caller turn your server into a proxy for requests to internal endpoints — cloud metadata services, internal admin APIs — that were never meant to be reachable from outside.

The five medium-severity fixes

• CVE-2026-64644 — self-hosted deployments that optimize remotely hosted images (not the default) can hit CPU exhaustion in /_next/image via malicious SVG content.
• CVE-2026-64646 — a crafted request can drive unbounded memory use in Server Actions running on the Edge runtime.
• CVE-2026-64643 — App Router Server Action and use cache endpoint IDs can be enumerated by an unauthenticated caller, useful for reconnaissance in a larger attack chain.
• CVE-2026-64648 and CVE-2026-64647 — a server-side fetch call of the form fetch(new Request(init), aDifferentInit) can return a cached response body from a different request to the same URL, including cases where the divergence is only in invalid UTF-8 byte sequences in the request body.

What changes for developers this week

Checking and bumping your installed version is a two-line job:

npm ls next --depth=0
npm install next@16.2.11   # or next@15.5.21 on the 15.5 branch

Beyond the version bump, three of the nine issues need a config check, not just an upgrade:

1. Turbopack + single-locale i18n (CVE-2026-64642) — if config.i18n.locales has exactly one entry and you build with Turbopack, verify your middleware actually re-runs its checks after upgrading rather than assuming the patch alone restores behavior you may have already routed around.
2. Dynamic rewrite/redirect destinations (CVE-2026-64645) — audit any rewrites()/redirects() rule that derives its destination hostname from query params, headers, or other request-controlled input.
3. Custom servers (CVE-2026-64649) — if you run Next.js behind a custom Node server rather than Vercel's platform, check what forwards Host-associated headers into outbound Server Action requests.

If you deploy to an edge platform with runtime feature flags — Cloudflare Workers with Wrangler Flagship, for example — gating the patched build behind a flag gives you a same-day rollback path if the upgrade itself regresses something, instead of a binary choice between an unpatched app and an untested production deploy.

The bigger pattern holds

The version list is the other signal worth reading closely: only 16.2 and 15.5 got patched builds, matching Vercel's May 2026 coordinated release where 13.x and 14.x received no back-ported fixes. Nine CVEs in one release, disclosed on a published date instead of arriving as a surprise, is what Vercel's new program is designed to produce — but it only protects teams that are on a currently maintained major to begin with. For anyone still on Next.js 13 or 14, the actionable item this week isn't watching for a patch; it's scoping the major-version upgrade that makes future monthly releases apply to them at all.