CVE-2026-64643: Vercel Next.js Auth Bypass Vulnerability

CVE-2026-64643 Overview

CVE-2026-64643 is an information exposure vulnerability [CWE-201] in Vercel Next.js. The flaw affects applications using App Router with Server Actions (use server) or use cache endpoints. Server Action IDs are disclosed to unauthenticated users through publicly served client artifacts, including static chunks that contain action references. The disclosure creates a reconnaissance and enumeration primitive that bypasses authentication checks on pages where these endpoints are used. The issue affects Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, and is fixed in 15.5.21 and 16.2.11.

Critical Impact
Unauthenticated attackers can enumerate Server Action IDs from static client chunks, bypassing authentication controls on Server Action and cache endpoints. Combined with other weaknesses, this can escalate into direct access to protected server-side functions.

Affected Products

Vercel Next.js versions 12.0.0 through 15.5.20
Vercel Next.js versions 16.0.0 through 16.2.10
Applications using App Router with Server Actions (use server) or use cache endpoints

Discovery Timeline

2026-07-27 - CVE CVE-2026-64643 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-64643

Vulnerability Analysis

Next.js compiles Server Actions declared with the use server directive into server-callable endpoints identified by opaque Server Reference IDs. During client bundling, references to these IDs can be emitted into static chunks that the framework serves publicly. Any unauthenticated visitor who fetches these chunks can extract the IDs and invoke the associated Server Actions directly. The framework did not validate that a supplied Server Reference ID matched the expected format or existed in the actions manifest before dispatching to the underlying handler. This turned an internal identifier into an attacker-reachable dispatch key. When authentication is enforced only at the page level rather than inside the action itself, the disclosure allows attackers to reach protected functionality.

Root Cause

The root cause is insufficient validation of Server Reference IDs during manifest lookup in the App Router action handler. The patch introduces mightBeServerReferenceId and adds two new error paths, getActionNotFoundError and getInvalidServerReferenceIdError, so that malformed or unknown references are rejected before execution. A new framework error The Server Reference ID did not match the expected format was added to errors.json under codes 1144 (16.x) and 793 (15.x).

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker retrieves publicly served JavaScript chunks from the target Next.js application, parses them to recover Server Action IDs, and issues crafted POST requests against the App Router endpoints referencing those IDs. Because the IDs act as dispatch tokens, the request reaches the Server Action even when the page that normally embeds it enforces authentication.

typescript

// Patch excerpt: packages/next/src/server/app-render/action-handler.ts
// Source: https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3
  type ServerModuleMap,
  getServerActionsManifest,
  getServerModuleMap,
+ getActionNotFoundError,
+ getInvalidServerReferenceIdError,
} from './manifests-singleton'
import { isNodeNextRequest, isWebNextRequest } from '../base-http/helpers'
import { normalizeFilePath } from './segment-explorer-path'
-import { extractInfoFromServerReferenceId } from '../../shared/lib/server-reference-info'
+import {
+  extractInfoFromServerReferenceId,
+  mightBeServerReferenceId,
+} from '../../shared/lib/server-reference-info'

The patch adds strict format validation and manifest membership checks before the handler dispatches to the referenced action. See the GitHub Security Advisory GHSA-955p-x3mx-jcvp for the full advisory.

Detection Methods for CVE-2026-64643

Indicators of Compromise

Repeated unauthenticated POST requests to App Router routes carrying Next-Action headers referencing IDs that never originated from an authenticated session.
Server logs containing the new framework error message The Server Reference ID did not match the expected format after upgrading, indicating probing attempts.
Automated scraping patterns fetching /_next/static/chunks/* followed by targeted action invocations.

Detection Strategies

Correlate access logs to identify clients that fetch static JavaScript chunks and then immediately issue Server Action requests without visiting the parent authenticated page.
Alert on POST requests to Next.js routes that include a Next-Action header when the request has no valid session cookie or authentication token.
Baseline the set of legitimate Server Action IDs from your build output and flag invocations of IDs outside that set.

Monitoring Recommendations

Ingest application and reverse-proxy logs into a centralized analytics platform and retain them for at least 90 days to support enumeration-pattern hunting.
Track error code 1144 (Next.js 16.x) or 793 (Next.js 15.x) as high-signal telemetry for post-patch probing.
Monitor for spikes in 4xx responses from Server Action endpoints, which typically indicate ID enumeration attempts.

How to Mitigate CVE-2026-64643

Immediate Actions Required

Upgrade Next.js to 15.5.21 or 16.2.11, which validate Server Reference IDs against the manifest before dispatch.
Audit all Server Actions and add explicit authorization checks inside each use server function rather than relying solely on page-level authentication.
Review recent access logs for unauthenticated requests targeting App Router action endpoints.

Patch Information

Vercel released fixes in GitHub Release v15.5.21 and GitHub Release v16.2.11. The remediation is implemented across two commits: commit 1b0c3ae for the 16.x branch and commit ff12a61 for the 15.x branch. Both introduce mightBeServerReferenceId validation and reject unknown or malformed reference IDs during manifest lookup.

Workarounds

Enforce authentication and authorization inside each Server Action body, treating action invocations as untrusted regardless of the referring page.
Place App Router routes that host sensitive Server Actions behind middleware that validates session state on every request, including POST invocations.
Restrict public access to build artifacts where feasible and rotate deployments after upgrading to invalidate previously disclosed Server Action IDs.

bash

# Upgrade Next.js to a patched release
npm install next@15.5.21
# or, for the 16.x line
npm install next@16.2.11

# Verify the installed version
npx next --version