Next.js July 2026 security release: 9 CVEs patched in 16.2.11 and 15.5.21

Summary. Vercel published the first scheduled Next.js security release on 20 July 2026, covering 9 CVEs: 4 rated high severity and 5 medium. The fixes are in v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS), and will land in v16.3.0 when that reaches stable. Four of the nine only bite specific configurations, so a blanket "patch everything tonight" order wastes a night that some teams do not have. W3Techs measured Next.js on 3.0% of all websites in July 2026, and 3.9% of sites whose JavaScript library it can identify. The stakes are not theoretical: when React2Shell (CVE-2025-55182, CVSS 10.0) was disclosed on 3 December 2025, Amazon's threat intelligence team saw China state-nexus groups exploiting it within hours. IBM put the average Indian data breach at ₹220 million in 2025, up 13% on ₹195 million in 2024, with a 263-day average lifecycle. This article maps each of the 9 CVEs to the exact configuration that triggers it, gives the upgrade commands, and covers what to do in the window before you can deploy.

What actually shipped on 20 July 2026

On 13 July 2026, Vercel announced that Next.js was moving from ad-hoc patches to a pre-announced security release program. The announcement named the date, the affected branches (16.2 and 15.5) and the severity mix (4 high, 5 medium) a week before any code shipped. That is the interesting part. Historically you found out about a Next.js security patch when it appeared, which meant a scramble.

The release itself is documented in the July 2026 security release post, authored by Andrew Imm, Josh Story and Sebastian Silbermann. Two commands cover almost every deployment:

            npm install next@15.5.21  # for the 15.5 line
npm install next@16.2.11  # for the 16.2 line
          

Nine CVEs in one release sounds alarming. Read the conditions and the picture changes: three of the four high-severity issues need a specific build configuration, a custom server, or a rewrite rule that interpolates user input into a hostname. The fourth, a denial of service through Server Actions, applies to almost every App Router app in production.

The four high-severity CVEs, and who is actually exposed

CVE-2026-64641: denial of service in App Router using Server Actions

Crafted requests aimed at an App Router application with at least one Server Action can drive excessive CPU usage. Because the CPU burn blocks further request processing in the same process, one attacker can take a worker offline. This is the broadest of the nine. If you run App Router and have written a single "use server" function, you are in scope.

CVE-2026-64642: middleware and proxy bypass with Turbopack and a single locale

App Router applications built with Turbopack that have exactly one entry in config.i18n.locales can be made to bypass middleware entirely. Every authentication check, tenant check or geo-gate you implemented in middleware stops running. The combination sounds exotic until you remember how many teams set a single locale to keep the i18n routing shape while shipping one language.

Check your config before you assume you are clear:

            // next.config.js
module.exports = {
  i18n: {
    locales: ['en'],      // a single entry is the trigger
    defaultLocale: 'en',
  },
}
          

If that block has one locale and your build uses Turbopack, treat this as your priority patch. Middleware bypass is the same failure class we covered in our breakdown of earlier Next.js middleware auth bypass advisories, and the operational lesson is unchanged: middleware is not an authorisation boundary you can rely on alone.

CVE-2026-64645: SSRF through rewrites with an attacker-controlled destination hostname

A rewrites() or redirects() rule that builds its external destination hostname out of request-controlled input can be pointed at any hostname, regardless of the suffix the rule appears to pin. For a rewrite, that is server-side request forgery, with your server making the outbound call. For a redirect, it is an open redirect.

The dangerous pattern looks reasonable in review:

            // next.config.js  -- vulnerable shape
async rewrites() {
  return [
    {
      source: '/proxy/:tenant/:path*',
      destination: 'https://:tenant.internal.example.com/:path*',
    },
  ]
}
          

On a cloud instance, SSRF is rarely just SSRF. It is the first hop toward an instance metadata endpoint and short-lived credentials.

CVE-2026-64649: SSRF in Server Actions on custom servers

When a Server Action forwards or redirects a request, an attacker who controls Host-associated headers can steer the outbound request to a malicious host. The condition is a custom server, so managed platform deployments are largely out of scope while self-hosted Node servers behind a reverse proxy are not. If your proxy passes client-supplied Host or X-Forwarded-Host headers through untouched, fix that at the proxy as well as in the framework.

The five medium-severity CVEs

Two of these deserve more attention than their medium rating suggests.

CVE-2026-64643 discloses endpoint IDs for Server Actions and use cache functions to unauthenticated callers. On its own it does nothing. As reconnaissance inside a longer chain, it hands an attacker the list of server entry points to probe. The React2Shell timeline is the reason to care about reconnaissance primitives: within a day of the 3 December 2025 disclosure, public exploits existed, and Google's Threat Intelligence Group documented distinct campaigns deploying a MINOCAT tunneler, a SNOWLIGHT downloader, and HISONIC and COMPOOD backdoors.

CVE-2026-64647 is the strangest bug in the set. A server-side fetch with a request body containing invalid UTF-8 can collide in the cache with a different request to the same URL. Vercel's own example is that the UTF-16 byte sequences for two different CJK strings share a cache key. If you proxy user-generated content through a server-side fetch, a cache hit can return another user's response body.

Triage table: patch order for a real team

Ordering matters when you cannot ship nine fixes and a full regression run in one evening.

The upgrade path, and the support clock behind it

The upgrade itself is a patch bump inside a minor line, so the blast radius is small compared with a major upgrade. What catches teams out is the version they are starting from.

Next.js 15.x was released on 21 October 2024 and Maintenance LTS runs two years from the initial release, which puts the 15.x line at end of support on 21 October 2026. If you are on 15.5.21 today, you have roughly three months before security patches stop. Plan the move to 16.x now rather than discovering the deadline during the next release. Our Next.js 16 migration guide covering async request APIs and Cache Components walks the breaking changes, and what the Rust and Go toolchain shift in 16.3 means covers where the line is heading.

Anything on 14.x or older receives nothing. Those apps are not "a bit behind"; they are unpatched against all nine of these CVEs permanently.

A practical upgrade sequence for a team with a real test suite:

            # 1. pin and record the current state
npm ls next react react-dom > pre-upgrade.txt

# 2. patch inside your line
npm install next@16.2.11      # or next@15.5.21

# 3. clean build, not an incremental one
rm -rf .next && npm run build

# 4. verify the resolved version actually moved
npm ls next
          

Step 4 is not padding. Lockfile resolution and a monorepo with several Next.js copies produce the most common failure in patch weeks: a green deploy that shipped the old version. Check the resolved tree, not the manifest.

What to do in the window before you can deploy

Not every team can push to production on a Monday. Compensating controls buy time, but none of them replaces the patch.

For CVE-2026-64642, the middleware bypass, the cleanest interim fix is architectural rather than configurational: move the authorisation check out of middleware and into the route handler or server component that reads the data. Middleware is a routing concern. Authorisation that only exists at the edge fails open whenever routing is bypassed, which is exactly what this CVE does.

For the two SSRF issues, audit next.config.js for any rewrite or redirect whose destination is built from a path parameter, query value or header, and replace the dynamic hostname with an allowlist lookup:

            const TENANT_HOSTS = {
  acme: 'https://acme.internal.example.com',
  globex: 'https://globex.internal.example.com',
}
// resolve from the map; never interpolate the raw parameter into a hostname
          

For the image endpoint issue, remove remote optimisation until you patch. Deleting remotePatterns from next.config.js takes the /_next/image remote path out of scope entirely, at the cost of unoptimised remote images for a few days.

For the Server Actions denial of service, rate limiting at the CDN or WAF layer in front of the app reduces the blast radius. It does not close the bug. A single well-formed request still costs more CPU than it should.

Why the cadence changed, and why it will keep getting busier

The nine CVEs are less interesting than the reason Vercel now needs a monthly slot for them. In the announcement, the team pointed at the volume of vulnerability research now being produced with LLM assistance, and cited Mozilla's disclosure of 271 issues fixed in a single Firefox release. Vercel runs the same class of tooling against Next.js through deepsec, its own researchers, and an expanded bug bounty scope.

Mozilla's own account of that Firefox work is worth reading before you treat a nine-CVE release as a sign of a framework in trouble. Bobby Holley, CTO of Firefox at Mozilla, wrote in The zero-days are numbered:

A gap between machine-discoverable and human-discoverable bugs favors the attacker, who can concentrate many months of costly human effort to find a single bug. Closing this gap erodes the attacker's long-term advantage by making all discoveries cheap.

Mozilla's numbers give the shape of the shift. Since February 2026 the Firefox team has been scanning the browser with frontier models; an earlier collaboration with Anthropic using Claude Opus 4.6 led to fixes for 22 security-sensitive bugs in Firefox 148. The later pass with an early version of Claude Mythos Preview produced the 271 fixes in Firefox 150. Same codebase, same quarter, roughly a twelvefold jump in what the tooling surfaced.

The operational conclusion for anyone running a framework in production: patch volume is going up, and it is going up because defenders got better tooling, not because the code got worse. A team that treats each security release as an unplanned fire drill will spend 2026 firefighting. A team that books a recurring two-hour slot the day after each scheduled release will spend 2026 patching. The recurring slot is the cheaper option, and the cadence is now published in advance specifically so you can book it.

The same reasoning applies across the dependency tree, not just to the framework. We covered the equivalent shift in the package registry in npm OIDC trusted publishing and cache poisoning hardening, and the enterprise triage version of the same problem in Patch Tuesday July 2026 and its 570 flaws.

India-specific considerations

For Indian teams the arithmetic is harsher than the global average. IBM's Cost of a Data Breach research put the average Indian breach at ₹220 million in 2025, a 13% rise on ₹195 million in 2024 and the highest average cost recorded worldwide that year. The average lifecycle to identify, contain and restore was 263 days, down 15 days on 2024 but still long enough that a bug introduced in one financial year gets discovered in the next.

Three points that matter specifically for teams shipping from India:

Under the Digital Personal Data Protection Act 2023, a personal data breach carries notification duties to the Data Protection Board and to affected data principals. An unpatched SSRF that reaches an internal service holding personal data is a reportable event, not an engineering inconvenience. Triage has to answer a second question alongside "is the app down": did any request reach data we hold on behalf of data principals?

Indian product teams disproportionately self-host on their own cloud accounts rather than deploying to a managed platform, which puts them inside the scope of the two CVEs that require a custom server or self-hosted image optimisation. The managed-platform exemption in the advisory does not apply to a Next.js app running on an EC2 instance behind Nginx.

Many Indian engineering teams still carry 14.x applications for internal tools and client projects handed over years ago. Those are permanently unpatched. If you maintain client applications on 14.x, the honest conversation to have this quarter is a budgeted upgrade, not another year of deferral. The real cost is usually the migration, not the patch.

FAQ

How eCorpIT can help

eCorpIT runs framework upgrade and patch-response work for product teams that cannot afford an unplanned outage every time a security release lands. That means an exposure audit against your actual next.config.js and deployment topology, a patch order matched to your release train, and the compensating controls to hold the line until the deploy window opens. We also handle the harder version of this problem: moving unsupported 14.x applications onto a supported line without a rewrite. If you want a second pair of eyes on your Next.js exposure this week, get in touch.

References

1. July 2026 Security Release - Next.js blog, Vercel, 20 July 2026.

1. Next.js Security Release and Our Next Patch Release - Next.js blog, Vercel, 13 July 2026.

1. Next.js Support Policy - Vercel, accessed 22 July 2026.

1. Usage statistics and market share of Next.js for websites - W3Techs, July 2026.

1. The zero-days are numbered - Bobby Holley, The Mozilla Blog, 21 April 2026.

1. China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) - AWS Security Blog.

1. Multiple Threat Actors Exploit React2Shell (CVE-2025-55182) - Google Cloud Threat Intelligence.

1. CVE-2025-55182 (React2Shell): Remote code execution in React Server Components and Next.js - Datadog Security Labs.

1. India Records Highest Average Cost of a Data Breach - IBM India Newsroom, 7 August 2025.

1. CVE-2026-64641 - CVE Program record.

1. CVE-2026-64642 - CVE Program record.

1. CVE-2026-64645 - CVE Program record.

1. CVE-2026-64649 - CVE Program record.

1. deepsec - Vercel Labs security tooling repository.

1. Vercel Open Source Bug Bounty - HackerOne programme page.

Last updated: 22 July 2026.