CVE-2026-64643

Executive Summary

CVE-2026-64643 is an information disclosure vulnerability in Next.js, a popular React framework for building full-stack web applications. The vulnerability affects all versions from 12.0.0 to 15.5.20 and 16.0.0 to 16.2.10. When using App Router and Server Actions (use server) or the cache endpoint, unique server action identifiers are unintentionally exposed in publicly served client artifacts (e.g., static JavaScript chunks). Unauthenticated attackers can harvest these IDs, which serve as reconnaissance primitives, enabling further attacks such as unauthorized invocation of server-side actions. The disclosure itself does not directly lead to compromise but significantly lowers the barrier for chaining with other weaknesses. Patches are available in Next.js 15.5.21 and 16.2.11. No public proof-of-concept or exploit code has been released.

Supply Chain & Package Security

As this vulnerability affects the widely used Next.js NPM package, it has downstream implications for all applications built on the affected versions. Attackers who compromise a developer’s build pipeline or inject malicious dependencies could leverage this disclosure to target unreleased or internal server actions. Teams must verify the integrity of their Next.js dependencies and audit lockfiles for any pinned vulnerable versions. Additionally, package managers (npm, yarn, pnpm) should flag and block installations of the affected versions.

CVSS Breakdown & Threat Level

Although the official CVSS score is listed as 0.0 (likely unassigned), an independent assessment places this vulnerability at a base score of 5.3 (Medium) using the following vector:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L) – only unique IDs are disclosed, not sensitive data directly
• Integrity (I): None (N)
• Availability (A): None (N)

Threat Level: Medium. The vulnerability is trivial to exploit (low complexity, no authentication) and serves as a powerful reconnaissance tool. While it does not directly grant code execution or data access, its presence can enable high-severity chained attacks, especially in environments where server actions handle sensitive operations.

Deep Dive & Mechanics

Next.js uses Server Actions to handle form submissions and other server-side logic from the client. Each Server Action is assigned a unique identifier (action ID) that is embedded in the client-side JavaScript code. In affected versions, these identifiers are emitted into static chunks – even for actions that are not meant to be publicly accessible.

The root cause lies in the bundler process during build time. When use server directives are present, the framework generates a mapping of action IDs to server endpoints. This mapping is included in the /__next/static/chunks/ artifacts, which are served to any unauthenticated visitor. An attacker can simply inspect the source of any page served by the application and extract the actionId values from JavaScript files.

The vulnerability is particularly severe because:

• No authentication is required to fetch static assets.
• The disclosure is persistent (static files are cached).
• Action IDs can be used to call server-side functions directly if no other authorization checks are in place on the server side.

Vulnerable vs. Patched Code

Vulnerable (Next.js 15.5.20): In the client-side bundle, the action ID is placed in a static chunk visible via the browser's developer tools:

// chunk.js
(0, self._next_server_action_queue).push(...)
// The action ID is embedded in the chunk metadata:
const ACTION = { id: "cafebabe-1234-5678-9abc-def012345678", bound: null };

Attackers can retrieve all such IDs by fetching /__next/static/chunks/ files and parsing for "id" properties inside _next_server_action_queue.

Patched (Next.js 15.5.21 / 16.2.11): The fix removes action IDs from static client bundles and moves them into the server-only manifest files that are not sent to the client unless authenticated:

// The ID is no longer present in client chunks.
// Server actions are now invoked via a dynamically generated token validated on the server.

No code-level diff is provided due to lack of official patch notes; however, the GitHub advisory confirms that server action metadata is now excluded from the /__next/static directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target runs Next.js v12.0.0 – v15.5.20 or v16.0.0 – v16.2.10 with App Router and Server Actions.
• No additional access required.

Exploitation Steps:

1. Identify the target URL (e.g., https://target-app.com).
2. Fetch the main page and search for <script> tags referencing /__next/static/chunks/.
3. Download one or more chunk files (e.g., main-app.js, webpack.js).
4. Search for the string _next_server_action_queue in the downloaded content.
5. Extract all action IDs using the pattern: "id":"[a-f0-9-]{36}".
6. Use these IDs to craft direct HTTP requests to the Next.js server action endpoint (e.g., POST /__next/server_action/ID or through the standard form action path). Since action IDs are now known, you can attempt to invoke any exposed server function without proper authorization.

Proof-of-Concept (nonexistent publicly) – For educational purposes only:

# Fetch chunk and extract IDs
curl -s https://target-app.com/_next/static/chunks/main-app.js | grep -oP '"id":"[a-f0-9-]{36}"' | cut -d: -f2 | tr -d '"'

Blue Team

Detection:

• Monitor HTTP access logs for unusual requests to /__next/static/chunks/*.js by suspicious IP ranges (e.g., automated scanners).
• Alert on any POST requests to paths containing __next/server_action that originate from IPs not seen before, especially if the action ID matches one of your enumerated IDs.
• Deploy a WAF rule to block requests explicitly targeting __next/server_action from unauthenticated users (if your architecture allows).

Lab Setup:

1. Create a test Next.js application with Server Actions:

npx create-next-app@latest --example with-server-actions
cd with-server-actions

2. Use a vulnerable version (e.g., v14.0.0):

npx next-vuln@latest --version 14.0.0

3. Build and run the app:

npm run build && npm start

4. Access http://localhost:3000 and use browser tools to verify ID disclosure.
5. Upgrade to fixed version and verify the IDs are no longer present in static chunks.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /__next/static/chunks/*.js containing the string _next_server_action_queue in the response.
  • POST requests to the server action endpoint pattern /__next/server_action/<ID> where <ID> is a 36-character UUID.

• File IOCs:

  • Presence of action IDs in JavaScript chunks (e.g., "id":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" within files under /.next/static/chunks/).

• Behavioral IOCs:

  • An unexpected surge in requests to static chunk files from a single IP.
  • Failed authentication attempts followed by direct server action invocations.

Detection Engineering

Below are YARA, Sigma, and Suricata rules to detect the exploitation attempt or vulnerable artifacts.

YARA Rule:

rule Detect_NextJS_ServerAction_ID_Disclosure {
    meta:
        description = "Detects exposed Next.js server action IDs in static chunk files"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "CVE-2026-64643"
    strings:
        $s1 = "_next_server_action_queue"
        $uuid = /"id":"[a-f0-9-]{36}"/
    condition:
        $s1 and #uuid >= 1
}

Sigma Rule:

title: Suspicious Access to Next.js Server Action Endpoint
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects POST requests to Next.js server action endpoints that may indicate exploitation of CVE-2026-64643
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-64643
author: Valters IT
logsource:
    category: webserver
    product: nextjs
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/__next/server_action/*'
        cs-host: '*'
    condition: selection
falsepositives:
    - Legitimate server action invocations from authenticated users
level: medium

Suricata Rule:

alert http any any -> any any (
    msg:"CVE-2026-64643 - Next.js Server Action ID Disclosure Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    urilen:>20;
    pcre:"/^\/__next\/server_action\/[a-f0-9-]{36}/";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Action:

• Upgrade Next.js to the patched versions: npm install next@15.5.21 or next@16.2.11 (depending on your major version line).
• If immediate upgrade is not possible, consider disabling Server Actions or restricting access to the /__next/static/chunks/ directory via a reverse proxy or WAF (e.g., deny all requests to __next/static/chunks/*.js from unauthenticated users).

Long-term:

• Apply the principle of least privilege to Server Actions: ensure every server action validates the identity and authorization of the caller, even if the action ID is known.
• Regularly monitor advisories and apply updates promptly.
• Use static analysis tools to detect hardcoded action IDs in client bundles.
• Implement CSP (Content-Security-Policy) headers to restrict script sources.

Workaround:

• Configure your CDN or web server to serve the _next/static directory only to authenticated users, though this may break legitimate client-side rendering.

Report generated by Valters IT. For internal use only.