highnextCVE-2026-64649
Next.js: Server-Side Request Forgery in Server Actions on custom servers
Affected versions
>= 14.1.1, < 15.5.21, fixed in 15.5.21>= 16.0.0, < 16.2.11, fixed in 16.2.11
Published 2026-07-22. Last checked 2026-11-01. Read the source advisory