CVE-2026-27978 Next.js: null origin can bypass Server Actions CSRF checks
Attackers can bypass Server Action CSRF checks using null origins from sandboxed iframes, allowing state-changing actions with victim credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-27978?
CVE-2026-27978 is a medium-severity vulnerability in Vercel Next.js, published on 17 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, `origin: null` was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests. An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF). This is fixed in version 16.1.7 by treating `'null'` as an explicit origin value and enforcing host/origin checks unless `'null'` is explicitly allowlisted in `experimental.serverActions.allowedOrigins`. If upgrading is not immediately possible, add CSRF tokens for sensitive Server Actions, prefer `SameSite=Strict` on sensitive auth cookies, and/or do not allow `'null'` in `serverActions.allowedOrigins` unless intentionally required and additionally protected.
Weakness: CWE-352
Which versions are affected by CVE-2026-27978?
2 open source packages ship an affected version, including next. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 16.0.1 | 16.1.7 |
next npm | From 16.0.1 | 16.1.7 |
Products include Vercel Next.js.
How do I fix CVE-2026-27978?
Upgrade next to 16.1.7 or later.
Is CVE-2026-27978 being exploited?
There is no known exploitation of CVE-2026-27978 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Vercel Next.js
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Sources
Also known as GHSA-mq59-m269-xvcx, MINI-c5hg-9ww7-fp9h, MINI-hrwq-7pv7-87hw, ROOT-APP-NPM-CVE-2026-27978.