Next.js shipped its first formal monthly security release on July 21, patching 9 vulnerabilities — 4 rated HIGH — across App Router, Server Actions, and Turbopack middleware. If your stack uses middleware.ts as the primary auth layer, one of those HIGH CVEs may have left a silent gap in your authentication. Upgrade to 15.5.21 or 16.2.11 now.
The Middleware Bypass Is the Critical One
CVE-2026-64642 (CVSS 8.3) is the vulnerability to prioritize. It affects App Router applications built with Turbopack that have a single entry in config.i18n.locales. In that specific configuration, specially crafted requests bypass middleware entirely — which means any authentication check, authorization rule, tenant routing logic, or security header your middleware enforces is silently skipped.
That is not a theoretical attack. Many App Router teams adopted the pattern of centralizing auth in middleware.ts — it is convenient, it runs at the edge, and it keeps route handlers clean. CVE-2026-64642 is a direct consequence of that pattern on the affected config. If you cannot upgrade immediately, move authorization into the page’s server-side data path (Server Components, getServerSideProps) and treat middleware as a routing layer only, not an auth boundary.
Two SSRF Vectors: Custom Servers Are Most Exposed
The release patches two independent server-side request forgery (SSRF) vulnerabilities.
CVE-2026-64649 affects Server Actions on custom Node.js servers. An attacker who can manipulate Host or X-Forwarded-Host headers can redirect outbound Server Action requests to an attacker-controlled host, and in some configurations can expose internal values that middleware or proxy layers use for authorization. Teams running Next.js on their own infrastructure — without a reverse proxy that normalizes Host headers — are most at risk. Managed Vercel hosting is not affected because Vercel secures Host headers upstream.
CVE-2026-64645 targets applications where rewrites() or redirects() rules build the external destination hostname from request-controlled input. If that hostname comes from a query parameter, path segment, or header, an attacker can point the server at an arbitrary host. The fix is the upgrade; the longer-term practice is to never build a redirect or rewrite destination from untrusted input without strict allowlisting.
Server Action DoS: Any Public Endpoint Is a Target
CVE-2026-64641 (CVSS 8.2) is straightforward: crafted requests to any App Router application with at least one Server Action can drive CPU usage high enough to block further request processing. No authentication required. If you expose Server Actions publicly — and most apps do — this is a denial-of-service vector without a configuration workaround. The fix is the upgrade.
What Is Not Affected
Before updating your incident response runbook, clarify your exposure:
- Pages Router only: None of these CVEs apply
- Non-Turbopack builds: CVE-2026-64642 (middleware bypass) does not apply
- Multi-locale i18n configs: CVE-2026-64642 requires exactly one entry in
config.i18n.locales - Vercel-managed hosting: SSRF via Host header manipulation (CVE-2026-64649) does not apply
How to Upgrade
npm install next@15.5.21 # maintenance LTS
npm install next@16.2.11 # active LTS (recommended)Earlier minors of 15.x and 16.x will not receive backports. If you are on 15.4.x or 16.1.x, a minor version bump is required. Both 16.2.11 and 15.5.21 are drop-in upgrades for most applications. Verify with npx next --version after upgrading.
The Bigger Change: Monthly Security Releases
This patch is more than nine CVE fixes. On July 13, Vercel announced that Next.js is moving to a formal monthly security release program. Each cycle will be pre-announced on the Next.js blog roughly a week ahead, with the expected date and highest anticipated severity disclosed in advance. Emergency out-of-band patches remain possible for actively exploited vulnerabilities.
Vercel cited the rise of AI-assisted vulnerability research as the motivation — noting that Mozilla disclosed 271 Firefox issues in a single release, all surfaced by AI tooling. More flaws are being found, and teams need a predictable window to plan upgrades. For the full CVE breakdown, see the official July 2026 security release post.
For Next.js teams, this means treating the framework like any other patched dependency: mark the third week of each month for a Next.js security check. Pin your CI to warn when the installed version falls behind the latest patch release. And if you are on a version that does not receive patches — any minor before 15.5 or 16.2 — you are running on a security-unsupported build.
App Router is powerful. Server Actions are convenient. Turbopack is fast. These CVEs are the other side of that power: more features running closer to sensitive data means a bigger attack surface. Staying on Active LTS (16.x) is no longer just a best practice — it is the minimum bar for a secure Next.js deployment. If you run on Netlify or another managed host, check your provider’s guidance for any platform-level mitigations already in place.
