Next.js July 2026 Security Release: Am I Affected?

Last updated: July 2026

TL;DR

Vercel shipped the first Next.js coordinated security release on July 20, 2026. It patches 9 CVEs (4 high, 5 medium) in App Router, Server Actions, Middleware/Proxy, and Image Optimization. It only lands in v16.2.11 and v15.5.21. If you run 13.x or 14.x, there is no patch coming. You must upgrade the major version. Below is a per-CVE checklist to test your exact config, plus the upgrade commands.

You get the Slack ping. "Next.js just shipped a security release. Are we affected?"

You open the announcement. Nine CVEs. Four high severity.

The post explains what each bug does. It does not tell you if your app has the condition that triggers it.

You do not need a summary of the announcement. You need to grep your own repo.

Here is the exact condition for each CVE, and the command to check it against your code.

What Shipped on July 20, 2026

This is Next.js's first scheduled security release. Vercel announced the program a week earlier. The idea: patch on a known schedule, not a surprise date.

Full technical detail for each CVE lives in the official July 2026 security release advisory. Treat this post as the checklist version of that page.

The July 20 release fixes 9 CVEs. Four are high severity. Five are medium.

Patches landed in two versions only:

• v16.2.11 (Active LTS)

• v15.5.21 (Maintenance LTS)

The fixes will also ship in v16.3.0 once it leaves canary.

If you are on 13.x or 14.x, neither version applies to you. Those majors are past end of life. They get no backport. The only fix is a major version upgrade.

The 4 High-Severity CVEs

CVE-2026-64641: DoS in App Router via Server Actions

The condition: Your app uses App Router. You have at least one Server Action (a function marked 'use server').

A crafted request spikes CPU usage. That blocks every other request on the same process.

Check your app:

bash

grep -rn "'use server'" app/ src/app/ 2>/dev/null

Any match means you are running Server Actions in App Router. You are affected until you patch.

CVE-2026-64642: Middleware bypass with Turbopack and single-locale i18n

The condition: You build with Turbopack. Your next.config sets exactly one locale in i18n.locales.

Under those two conditions together, middleware and proxy checks get skipped. Any auth logic in your middleware does not run.

Check your app:

bash

grep -n "turbopack" next.config.js next.config.ts package.json 2>/dev/null
grep -n "i18n" next.config.js next.config.ts 2>/dev/null

If Turbopack is on and i18n.locales has one entry, you are affected. Two or more locales, or a webpack build, or the newer proxy.ts convention, are not affected by this specific CVE.

CVE-2026-64645: SSRF and open redirect via rewrites and redirects

The condition: A rewrites() or redirects() rule in next.config builds its destination hostname from request input. Think a query param, a header, or a path segment used to construct the target URL.

An attacker can point that rule at any host they want. On a rewrite, that is server-side request forgery. On a redirect, that is an open redirect.

Check your app:

bash

grep -n -A 10 "rewrites\|redirects" next.config.js next.config.ts 2>/dev/null

Read every match. Does the destination string pull from request, searchParams, headers, or route params? Then you are affected.

CVE-2026-64649: SSRF in Server Actions on custom servers

The condition: You run a custom server (server.js with next({ dev })). A Server Action forwards or redirects a request. The attacker controls a Host-related header on the inbound request.

The server can be tricked into sending that outbound request to a host the attacker owns.

Check your app:

bash

find . -maxdepth 1 -iname "server.js" -o -iname "server.ts" 2>/dev/null

If that file exists, look closer. Do you host it yourself, without a platform that normalizes the Host header? Then review every Server Action that forwards or redirects a request.

The 5 Medium-Severity CVEs

CVE-2026-64644: DoS in Image Optimization API via malicious SVGs

The condition: You self-host Next.js. You use the default image loader. You allow remote images through images.remotePatterns or images.domains.

A malicious remote SVG can spike CPU on the /_next/image endpoint.

Check your app:

bash

grep -n -A 5 "remotePatterns\|domains" next.config.js next.config.ts 2>/dev/null

If you self-host and this returns a match, you are affected.

CVE-2026-64646: Unbounded Server Action payload on the Edge runtime

The condition: App Router. At least one Server Action. That action runs on the Edge runtime.

A crafted request can consume unbounded memory.

Check your app:

bash

grep -rn "runtime.*edge" app/ src/app/ 2>/dev/null

Cross-reference the files that match with your Server Action files from the CVE-2026-64641 check above.

CVE-2026-64643: Server Function endpoint IDs get disclosed

The condition: App Router. You use Server Actions or use cache.

Their internal endpoint IDs can leak to an unauthenticated caller. That is reconnaissance for a bigger attack, not a direct breach on its own.

Check your app: if you matched CVE-2026-64641 or use use cache anywhere, you are affected. There is no config flag to check. The fix is the version upgrade.

CVE-2026-64648 and CVE-2026-64647: Cache confusion on fetch calls with a body

The condition for 64648: A server-side fetch shaped like this:

typescript

fetch(new Request(init), aDifferentInit)

The response cache can return a body from a different request to the same URL.

The condition for 64647: Same underlying cache confusion, triggered instead by a request body with invalid UTF-8 byte sequences.

Check your app:

bash

grep -rn "new Request(" app/ src/app/ lib/ src/lib/ 2>/dev/null

Any match that passes a second init object into fetch is worth a manual look.

Am I Affected on 13.x or 14.x?

Short answer: you are exposed, and you get no patch.

Next.js 14 reached end of life in October 2025. Next.js 13 is older still. Vercel's own May 2026 security release set the precedent: no backport to 13.x or 14.x. This July release follows the same pattern.

If a dependency scanner flags your Next.js version against these 9 CVEs, there is no minor-version fix to apply. Your path is a major version upgrade to a supported line.

How to Upgrade

Pick your track based on your current major version.

On Next.js 16:

bash

npm install next@16.2.11

On Next.js 15:

bash

npm install next@15.5.21

On Next.js 13 or 14:

There is no direct patch. Run the upgrade codemod to move to a supported major first:

bash

npx @next/codemod@latest upgrade latest

Budget real testing time here. Jumping two major versions touches routing, data fetching, and caching. Not just this security fix.

What If I Cannot Upgrade Right Now?

Some of these have partial mitigations while you plan the upgrade.

For CVE-2026-64642, drop to a webpack build or add a second locale until you can patch. Both remove the specific trigger condition.

For CVE-2026-64645, add hostname allowlisting inside your rewrites() function instead of trusting request input directly.

For the rest, there is no safe workaround. The CPU and memory exhaustion bugs, the SSRF in custom servers, and the cache confusion issues all require the version bump. Treat the config-level mitigations as a bridge, not a destination.

Do you deploy Server Actions in App Router? The nextjs-cache-not-updating-server-action post covers the caching model behind them. Prioritize the upgrade this week. Not next sprint.

Key Takeaways

• The Next.js July 2026 security release patches 9 CVEs across App Router, Server Actions, Middleware/Proxy, and Image Optimization.

• Four CVEs are high severity: Server Action DoS, Turbopack middleware bypass, rewrites/redirects SSRF, and custom-server SSRF.

• Patches exist only for v16.2.11 and v15.5.21. There is no backport for 13.x or 14.x.

• Grep your next.config for rewrites(), redirects(), remotePatterns, and i18n.locales before you assume you are safe.

• Any App Router app with a Server Action is affected by at least 3 of the 9 CVEs.

• If you are on 13.x or 14.x, plan a major version upgrade, not a patch.

• Config-level mitigations exist for 2 of the 9 CVEs. The rest need the version bump.

FAQ

• Does the July 2026 security release affect the Pages Router?

  Most of these 9 CVEs target App Router, Server Actions, and Middleware/Proxy specifically. If your app is fully on the Pages Router with no App Router code, your exposure is much smaller. Still run the upgrade. The Image Optimization CVE applies regardless of router.

• Is Vercel-hosted Next.js safe by default?

  Vercel's managed image optimization is not the self-hosted default loader path that CVE-2026-64644 targets. But Server Action and Middleware CVEs depend on your code, not your host. Hosting on Vercel does not replace the version upgrade.

• Do I need to patch if I do not use Turbopack?

  CVE-2026-64642 needs Turbopack plus a single-locale i18n.locales config. Without Turbopack, that specific CVE does not apply to you. The other 8 CVEs are unrelated to your build tool.

• What is the difference between v16.2.11 and v16.3.0 for this fix?

  Both contain the fix. v16.2.11 is the patched Active LTS release available now. v16.3.0 is the next minor. It is still in canary and preview. The fix ships inside it once it goes stable.

• Can I disable Server Actions instead of upgrading?

  Removing every 'use server' function closes 3 of the CVEs. But that is a bigger change than upgrading the package. It also skips the Middleware, rewrites, and Image Optimization CVEs. Upgrade instead.

• Does this release include any breaking changes?

  Vercel classifies this as a patch-focused release with backported fixes. Maintenance LTS updates can still ship as semver-minor even when they carry breaking-style changes. Test your build after upgrading. This is not a feature release.

• How do I know if my rewrites() rule is vulnerable to CVE-2026-64645?

  Open every rule inside rewrites() and redirects() in your next.config. Is the destination hostname built from the incoming request? That could be a header, a search param, or a route segment. If so, you match the condition. A hardcoded hostname does not.

• When does Next.js 15 stop getting security patches entirely?

  Next.js 15 is in Maintenance LTS until October 21, 2026. After that date, it stops receiving security updates the same way 14.x does now.

Every App Router App with Server Actions Needs This Patch This Week

Nine CVEs shipped in one release. Three of them hit any App Router app running a single Server Action.

That is not a rare configuration. That is most Next.js apps built after 2023.

Run the grep commands above against your own repo before you trust a scanner's summary of the announcement. Then upgrade to v16.2.11 or v15.5.21 today, and start the major-version migration this week if you are stuck on 13.x or 14.x.

These CVEs live in the App Router world. For the Suspense boundary rules that came with that shift, the usesearchparams-needs-suspense-nextjs post covers the details. And if the upgrade itself breaks your Vercel build, the nextjs-build-fails-on-vercel post walks through the common causes.

Subscribe for the next patch breakdown before the scanners and news aggregators catch up.