Is there a patch available for CVE-2026-64643?

Yes, a patch is available for CVE-2026-64643. Update the affected software to the latest version immediately.

Next.js CVE-2026-64643

Q: What is the CVSS score of CVE-2026-64643?

CVE-2026-64643 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-49383 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-07-22 https://github.com/vercel/next.js

GHSA-955p-x3mx-jcvp

Information Disclosure Red Hat

6.3

CVSS 4.0 · Vendor: https://github.com/vercel/next.js

Severity by source

Vendor (https://github.com/vercel/next.js) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Static JS chunks are publicly served without authentication, so AV:N/PR:N/AC:L; disclosure of action IDs alone has low confidentiality impact and no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (https://github.com/vercel/next.js).

CVSS VectorVendor: https://github.com/vercel/next.js

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 27, 2026 - 18:22 NVD

6.3 (MEDIUM)

Source Code Evidence Fetched

Jul 22, 2026 - 23:19 vuln.today

Analysis Generated

Jul 22, 2026 - 23:19 vuln.today

CVE Published

Jul 22, 2026 - 23:00 cve.org

MEDIUM

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

16 npm packages depend on next (15 direct, 1 indirect)

Ecosystem-wide dependent count for version 13.0.0.

DescriptionCVE.org

Impact

In Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used.

Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references).

Affected users are applications using App Router + Server Actions.

By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses.

Workarounds

Never assume any authentication claims at the use cache or use server boundary. Always authenticate within the boundary.

AnalysisAI

Server Action endpoint IDs in Next.js App Router applications are exposed to unauthenticated users through publicly served client-side static JavaScript chunks, effectively bypassing page-level authentication gates on those endpoints. Applications running Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 with App Router and Server Actions (use server) or use cache directives are affected. Standalone exploitation provides an enumeration primitive rather than direct data access, but the disclosed IDs can amplify secondary weaknesses - particularly when Server Actions perform sensitive operations without re-authenticating callers within the action boundary itself. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.

Technical ContextAI

Next.js App Router compiles Server Actions (use server) and use cache endpoints into deterministic IDs that are embedded in client-side JavaScript bundles distributed as publicly accessible static chunks. These IDs serve as opaque references enabling the browser to call back to server-side functions, but because they live in assets sent to every visitor regardless of authentication state, any unauthenticated party can extract them. CWE-201 (Insertion of Sensitive Information Into Sent Data) captures the root cause: the framework inadvertently includes internal server-function references in externally served artifacts. The commit diff confirms the fix adds format validation (mightBeServerReferenceId) and hardens the server module map lookup to reject malformed or unexpected IDs, reducing the attack surface around action resolution. The affected package is pkg:npm/next, covering versions ≥13.0.0 <15.5.21 and ≥16.0.0 <16.2.11.

RemediationAI

Upgrade to Next.js 15.5.21 (15.x branch) or 16.2.11 (16.x branch), as confirmed by the tagged GitHub releases at https://github.com/vercel/next.js/releases/tag/v15.5.21 and https://github.com/vercel/next.js/releases/tag/v16.2.11, backed by patches in commits 1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3 and ff12a6124e1504f17b62de948b8a553fdecaef7b. Where immediate upgrade is not feasible, the advisory's workaround is to authenticate all sensitive operations within each use server or use cache action boundary rather than relying on the surrounding page's authentication middleware - this directly neutralizes the risk even before patching, because a disclosed action ID alone cannot bypass authentication enforced inside the action itself. Note that this workaround requires an audit of every Server Action to confirm it performs its own identity verification, which may be a non-trivial code review effort in large applications.