概要
公開日: 2026-07-20
翻訳生成に失敗したため、原文をそのまま保存しています。
原文
Back to Blog Monday, July 20th 2026 July 2026 Security Release Posted by Andrew Imm @ setimmediate Josh Story @ joshcstory Sebastian Silbermann @ sebsilbermann Last week we announced that Next.js would be moving to a preannounced security release model, with patches announced ahead of time so that teams can plan for them. Updates are now available in v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS) to address these issues. Please patch your Next.js dependencies to maintain the security of your applications. Terminal npm install next@15.5.21 # for 15.5 npm install next@16.2.11 # for 16.2 These fixes are also available in the latest Next.js 16.3 canary ( v16.3.0-canary.92 ) and preview ( v16.3.0-preview.7 ) releases, and will be included in v16.3.0 once it reaches a stable release. Terminal npm install next@16.3.0-canary.92 # canary npm install next@16.3.0-preview.7 # preview Impact Denial of Service in App Router using Server Actions (High Severity) CVE-2026-64641 Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage. The CPU usage blocks processing of further requests in the same process, leading to Denial of Service. Middleware / Proxy bypass in App Router applications using Turbopack and single locale (High Severity) CVE-2026-64642 Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales are vulnerable to a middleware/proxy bypass. Accordingly, any authentication or security checks that a middleware/proxy may perform are bypassed. Server-Side Request Forgery in rewrites via attacker-controlled destination hostname (High Severity) CVE-2026-64645 A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For rewrites, this behavior enables Server-Side Request Forgery (SSRF); for redirects, Open Redirect can be achieved. Server-Side Request Forgery in Server Actions on custom servers (High Severity) CVE-2026-64649 When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker’s request to control Host-associated headers. Denial of Service in the Image Optimization API using SVGs (Medium Severity) CVE-2026-64644 When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, the images can cause CPU exhaustion in the /_next/image endpoint. Unbounded Server Action payload in Edge runtime (Medium Severity) CVE-2026-64646 A crafted request can lead to memory consumption on Server Actions in the Edge runtime. Next.js applications which use App Router and have at least one Server Action are affected. Unauthenticated disclosure of internal Server Function endpoints (Medium Severity) CVE-2026-64643 In Next.js applications using App Router, Server Actions (use server) or use cache endpoint IDs can be globally disclosed. An attacker can use this for reconnaissance and as part of a broader attack chain. Cache confusion of response bodies for requests with bodies (Medium Severity) CVE-2026-64648 A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This only applies for fetch calls of the following shape: fetch ( new Request (init) , aDifferentInit) Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences (Medium Severity) CVE-2026-64647 A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This only applies when receiving request bodies which contain invalid UTF-8 characters. For example, the UTF-16 byte sequences f