Next.js July 2026 Security Release: 9 CVEs, 4 Critical, and the New Pre-Announced Patch Model

Next.js July 2026 Security Release: 9 CVEs, 4 Critical, and the New Pre-Announced Patch Model

On July 20, 2026, Next.js published its first pre-announced security release: 9 vulnerabilities patched at once, 4 of them critical. Here is the complete analysis of each CVE, the impact on your app, and a concrete migration plan.

On July 20, 2026, the Next.js team published a coordinated security release patching 9 vulnerabilities — 4 of High severity and 5 of Medium severity — simultaneously in v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS). This release also marks the launch of the new pre-announced patch model, announced a week earlier on July 13.

For any Next.js application in production, this release is non-negotiable. Versions 13.x and 14.x, now end-of-life, will receive no backport. This guide breaks down each CVE, identifies at-risk configurations, and provides a concrete migration plan for teams.

---

The New Pre-Announced Security Release Model

Historically, Next.js published security fixes on an ad-hoc basis, with no predictable schedule. On July 13, 2026, Vercel announced a process change: security releases will now be scheduled and pre-announced, giving teams time to prepare updates before public disclosure of details.

Workflow of the new pre-announced security release model for Next.js

The first July 2026 security release illustrates this process:

• July 13: program and July 21 date announcement
• July 20: coordinated publication of fixes (one day before announced date)
• Fixes available in v16.2.11, v15.5.21, and 16.3 canary/preview builds

# Immediate update
npm install next@16.2.11   # for 16.x line
npm install next@15.5.21   # for 15.x line

---

The 4 High Severity CVEs

CVE-2026-64641: Denial of Service in App Router via Server Actions

Severity: High | GHSA: m99w-x7hq-7vfj

This vulnerability allows an attacker to trigger a denial of service in the App Router by exploiting Server Actions. Server Actions, introduced as the recommended model for server-side data mutations, expose an attack surface when payloads are not properly bounded.

At-risk configurations:

• Any application using 'use server' in the App Router
• Server Actions without strict payload size validation
• Custom server deployments (non-Vercel) particularly exposed

CVE-2026-64642: Middleware Bypass with Turbopack and Single Locale

Severity: High | GHSA: 6gpp-xcg3-4w24

This CVE is particularly dangerous: it allows bypassing authentication checks in middleware when the application is compiled with Turbopack and uses a single-locale i18n configuration.

At-risk configurations:

• Applications with turbopack: true in next.config.ts
• Authentication middleware (middleware.ts)
• i18n configuration with a single locale (e.g., locales: ['en'])

CVE-2026-64645: SSRF via Rewrites with Attacker-Controlled Hostname

Severity: High | GHSA: p9j2-gv94-2wf4

A Server-Side Request Forgery vulnerability in the rewrites system when the destination hostname is controllable by the attacker. This can potentially reach internal services.

At-risk configurations:

• rewrites() in next.config.ts with dynamic parameters
• Destination based on user-controlled headers or query params
• Self-hosted deployments behind a reverse proxy

CVE-2026-64649: SSRF in Server Actions on Custom Servers

Severity: High | GHSA: 89xv-2m56-2m9x

Similar to the previous one but specific to Server Actions on custom servers. Vercel deployments are not affected because they use a URL resolver that neutralizes SSRF attempts.

At-risk configurations:

• Custom server (Node.js standalone, Docker)
• Server Actions performing internal HTTP requests
• No Host header validation

---

The 5 Medium Severity CVEs

CVE-2026-64644: DoS in Image Optimization API via Malicious SVGs

Severity: Medium | GHSA: q8wf-6r8g-63ch

The Image Optimization API can be brought down by maliciously crafted SVGs that excessively consume resources during processing.

CVE-2026-64646: Unbounded Server Action Payload on Edge Runtime

Severity: Medium | GHSA: 4c39-4ccg-62r3

On the Edge runtime, Server Action payloads are not properly size-limited, allowing memory exhaustion.

CVE-2026-64643: Unauthenticated Disclosure of Server Function Endpoints

Severity: Medium | GHSA: 955p-x3mx-jcvp

Server Function endpoint IDs are disclosed without authentication, giving an attacker a map of available server routes.

CVE-2026-64648: Cache Confusion for Requests with Bodies

Severity: Medium | GHSA: 68g3-v927-f742

Requests with bodies can interfere with the Next.js cache, potentially returning incorrect responses.

CVE-2026-64647: Cache Confusion with Invalid UTF-8 Byte Sequences

Severity: Medium | GHSA: 4633-3j49-mh5q

A variant of the previous one: invalid UTF-8 byte sequences in the body can corrupt cache entries.

---

Impact and Criticality Matrix

Distribution of the 9 CVEs by severity and affected component

The matrix above shows that Server Actions and Middleware/Proxy components concentrate the most critical vulnerabilities. If your application uses these features, the update is urgent.

---

Migration Plan by Scenario

Scenario 1: You're on Next.js 16.x

This is the simplest case. Update to v16.2.11:

npm install next@16.2.11
npm run build   # verify the build passes

Then check that you don't have transitive dependencies on old versions:

npm ls next
# or
pnpm why next

If you see versions below 16.2.11 in the tree, lock the floor:

{
  "overrides": {
    "next": ">=16.2.11"
  }
}

Scenario 2: You're on Next.js 15.x

Update to v15.5.21:

npm install next@15.5.21

Note that Next.js 15 is in Maintenance LTS until October 21, 2026. After this date, it will no longer receive security updates. Plan a migration to 16.x.

Scenario 3: You're on Next.js 13.x or 14.x

This is the hardest scenario. There is no backport. You must perform a major version migration.

Decision tree for migration based on your current Next.js version

Migrating from 14.x to 16.x involves several breaking changes:

1. Async APIs: params, searchParams become asynchronous in 16
2. React 19: peer dependency, update compatible libraries
3. Image defaults: changes in default next/image behavior
4. Cache: fetch and GET route handlers are no longer cached by default

# Step 1: migrate to 15.5.21 with compat layer
npm install next@15.5.21 react@19 react-dom@19

# Step 2: fix deprecation warnings
npm run build

# Step 3: once stable, migrate to 16.2.11
npm install next@16.2.11

Scenario 4: Self-hosted Deployment (Docker, VPS)

Self-hosted deployments are particularly exposed to CVE-2026-64649 (SSRF Server Actions custom server) because they lack the Vercel resolver.

FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm install next@16.2.11
COPY . .
RUN npm run build
CMD ["npm", "start"]

Also add Host header validation in your middleware:

// middleware.ts
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

export function middleware(request: NextRequest) {
  const host = request.headers.get('host');
  const allowedHosts = ['mydomain.com', 'www.mydomain.com'];
  
  if (host && !allowedHosts.includes(host)) {
    return new NextResponse('Forbidden', { status: 403 });
  }
  
  return NextResponse.next();
}

---

Post-Migration Verification Checklist

After updating Next.js, verify these points:

• npm ls next shows only versions >= 15.5.21 or >= 16.2.11
• npm run build passes without errors
• Server Actions work with payload validation
• Authentication middleware is tested with Turbopack
• Rewrites don't contain unvalidated dynamic parameters
• Image Optimization API correctly rejects SVGs
• e2e tests pass (Playwright, Cypress)
• Monitoring shows no performance regression

Radar of post-migration security verification coverage for Next.js

---

What Pre-Announced Models Change for Teams

The shift to a pre-announced security release model transforms update management:

1. Predictability: DevOps teams can block maintenance windows in advance
2. Coordination: hosting providers (Netlify, Vercel, AWS) can prepare their platforms
3. Responsible disclosure: researchers who report vulnerabilities know when their findings will be published

Netlify, for example, published their impact analysis on July 21, 2026, indicating that three of the nine CVEs did not affect their customers (Server Action Host forwarding, Image Optimizer DoS, Edge-runtime OOM).

For teams managing Next.js in production, the expected monthly cadence implies:

• A Next.js release monitoring channel (RSS, GitHub advisories)
• A CI/CD process capable of deploying a patch in under 48h
• Automated non-regression tests

---

Conclusion

The July 2026 security release is a textbook case of coordinated disclosure: 9 CVEs, a single release, a one-week notice, and zero backport for end-of-life versions. If you manage a Next.js application, updating to v16.2.11 or v15.5.21 is the most urgent action of your week.

For teams on 13.x or 14.x, this release is a clear signal: the cost of migration delay is increasing. Without backport, every unpatched CVE is technical debt with a direct security impact. If your company needs help planning this migration, our web development expertise covers complex Next.js migrations with automated testing.

The question is no longer should you migrate, but when. With a monthly pre-announced model, the window between each release is 30 days — that's the time you have to be ready before the next one.