Server-Side Request Forgery in Next.js Server Actions on custom servers (CVE-2026-64649)

When a Server Action forwards or redirects a request in Next.js, an attacker who controls Host-associated headers can cause the server to issue outbound requests to an arbitrary host. In some configurations, this may also expose internal values that weaken middleware or proxy authorization. Applications using Server Actions on custom servers or deployments not behind a host-pinning proxy are affected. Affected versions: - >= 14.1.1 < 15.5.21 - >= 16.0.0 < 16.2.11 We recommend updating to: 15.5.21, 16.2.11. CVSS 8.3 · our assessment: this_week Reference: https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x Details: https://vuln.today/cve/CVE-2026-64649