GHSA-jcc7-9wpm-mj36 CVE-2026-27977
Next.js: null origin can bypass dev HMR websocket CSRF checks
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.18%
- Chance of exploitation in the next 30 days. Higher than 7.36% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1385 Missing Origin Validation in WebSockets
- Fix
16.1.7- Upgrade next to this version or later
Description
Summary
In next dev, cross-site protections for internal development endpoints could treat Origin: null as a bypass case even when allowedDevOrigins is configured. This could allow privacy-sensitive or opaque browser contexts, such as sandboxed documents, to access privileged internal dev-server functionality unexpectedly.
Impact
If a developer visits attacker-controlled content while running an affected next dev server with allowedDevOrigins configured, attacker-controlled browser code may be able to connect to internal development endpoints and interact with sensitive dev-server functionality that should have remained blocked.
This issue affects development mode only. It does not affect next start, and it does not expose internal debugging functionality to the network by default.
Patches
Fixed by validating Origin: null through the same cross-site origin-allowance checks used for other origins on internal development endpoints.
Workarounds
If upgrade is not immediately possible:
- Do not expose
next devto untrusted networks. - If you use
allowedDevOrigins, reject requests and websocket upgrades withOrigin: nullfor internal dev endpoints at your proxy.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| next | >= 16.0.1, < 16.1.7 |
16.1.7 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
next npm → 16.1.7
- npm
npm install next@16.1.7- yarn
yarn add next@16.1.7- pnpm
pnpm add next@16.1.7
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- Passive
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 5.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-1385: Missing Origin Validation in WebSockets
The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
How to prevent it
- Implementation: Enable CORS-like access restrictions by verifying the 'Origin' header during the WebSocket handshake.
- Implementation: Use a randomized CSRF token to verify requests.
- Implementation: Use TLS to securely communicate using 'wss' (WebSocket Secure) instead of 'ws'.
- Architecture and Design, Implementation: Require user authentication prior to the WebSocket connection being established. For example, the WS library in Node has a 'verifyClient' function.
- Implementation: Leverage rate limiting to prevent against DoS. Use of the leaky bucket algorithm can help with this.
- Implementation: Use a library that provides restriction of the payload size. For example, WS library for Node includes 'maxPayloadoption' that can be set.
- Implementation: Treat data/input as untrusted in both directions and apply the same data/input sanitization as XSS, SQLi, etc.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-673q-mjm6-r5xr Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays | Critical | Also affects next |
| GHSA-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used | Critical | Also affects next |
| GHSA-p3m5-59mp-jv5r Next.js: Denial of Service in App Router using Server Actions | High | Also affects next |
| GHSA-3w37-wq28-93x7 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages | Medium | Also affects next |
| GHSA-4jqv-mc3x-m676 Next.js has cache poisoning of SSG and ISR pages in self-hosted applications | Medium | Also affects next |
| GHSA-39w2-rjm5-chcv Next.js has information disclosure in development server's Model Context Protocol endpoint | Medium | Also affects next |
| GHSA-f87g-xv8r-7p7x Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass | Medium | Also affects next |
| GHSA-mcj8-r9mp-w47p Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service | Medium | Also affects next |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor