CVE-2026-27977 Next.js: null origin can bypass dev HMR websocket CSRF checks
Attackers can bypass CSRF protections in Next.js development mode via null origin, allowing unauthorized access to HMR websocket channels.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-27977?
CVE-2026-27977 is a low-severity vulnerability in Vercel Next.js, published on 17 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured `allowedDevOrigins` still allow connections from any origin. The issue is fixed in version 16.1.7 by validating `Origin: null` through the same cross-site origin-allowance checks used for other origins. If upgrading is not immediately possible, do not expose `next dev` to untrusted networks and/or block websocket upgrades to `/_next/webpack-hmr` when `Origin` is `null` at the proxy.
Weakness: CWE-1385
Which versions are affected by CVE-2026-27977?
2 open source packages ship an affected version, including next. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 16.0.1 | 16.1.7 |
next npm | From 16.0.1 | 16.1.7 |
Products include Vercel Next.js.
How do I fix CVE-2026-27977?
Upgrade next to 16.1.7 or later.
Is CVE-2026-27977 being exploited?
There is no known exploitation of CVE-2026-27977 in the wild and no public exploit code.
Other vulnerabilities in Vercel Next.js
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Sources
Also known as GHSA-jcc7-9wpm-mj36, MINI-2cf9-7cm4-pw78, MINI-cm4h-5qgp-wv26, ROOT-APP-NPM-CVE-2026-27977.