---
title: July 2026 Security Release
description: The July 2026 security release for Next.js is now available
url: "https://nextjs.org/blog/july-2026-security-release"
docs_index: /docs/llms.txt
publishedAt: July 20th 2026
authors:
  - Andrew Imm
  - Josh Story
  - Sebastian Silbermann
---



[Last week](/blog/next-security-release-program) we announced that Next.js would be moving to a preannounced security release model, with patches announced ahead of time so that teams can plan for them.

Updates are now available in v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS) to address these issues. Please patch your Next.js dependencies to maintain the security of your applications.

```bash filename="Terminal"
npm install next@15.5.21  # for 15.5
npm install next@16.2.11  # for 16.2
```

These fixes are also available in the latest Next.js 16.3 canary (`v16.3.0-canary.92`) and preview (`v16.3.0-preview.7`) releases, and will be included in `v16.3.0` once it reaches a stable release.

```bash filename="Terminal"
npm install next@16.3.0-canary.92   # canary
npm install next@16.3.0-preview.7   # preview
```

## Impact

### Denial of Service in App Router using Server Actions (High Severity)

[**CVE-2026-64641**](https://www.cve.org/CVERecord?id=CVE-2026-64641)

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage. The CPU usage blocks processing of further requests in the same process, leading to Denial of Service.

### Middleware / Proxy bypass in App Router applications using Turbopack and single locale (High Severity)

[**CVE-2026-64642**](https://www.cve.org/CVERecord?id=CVE-2026-64642)

Next.js applications using App Router built with Turbopack and a single entry in `config.i18n.locales` are vulnerable to a middleware/proxy bypass. Accordingly, any authentication or security checks that a middleware/proxy may perform are bypassed.

### Server-Side Request Forgery in rewrites via attacker-controlled destination hostname (High Severity)

[**CVE-2026-64645**](https://www.cve.org/CVERecord?id=CVE-2026-64645)

A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For rewrites, this behavior enables Server-Side Request Forgery (SSRF); for redirects, Open Redirect can be achieved.

### Server-Side Request Forgery in Server Actions on custom servers (High Severity)

[**CVE-2026-64649**](https://www.cve.org/CVERecord?id=CVE-2026-64649)

When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker’s request to control Host-associated headers.

### Denial of Service in the Image Optimization API using SVGs (Medium Severity)

[**CVE-2026-64644**](https://www.cve.org/CVERecord?id=CVE-2026-64644)

When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, the images can cause CPU exhaustion in the `/_next/image` endpoint.

### Unbounded Server Action payload in Edge runtime (Medium Severity)

[**CVE-2026-64646**](https://www.cve.org/CVERecord?id=CVE-2026-64646)

A crafted request can lead to memory consumption on Server Actions in the Edge runtime. Next.js applications which use App Router and have at least one Server Action are affected.

### Unauthenticated disclosure of internal Server Function endpoints (Medium Severity)

[**CVE-2026-64643**](https://www.cve.org/CVERecord?id=CVE-2026-64643)

In Next.js applications using App Router, Server Actions (use server) or use cache endpoint IDs can be globally disclosed. An attacker can use this for reconnaissance and as part of a broader attack chain.

### Cache confusion of response bodies for requests with bodies (Medium Severity)

[**CVE-2026-64648**](https://www.cve.org/CVERecord?id=CVE-2026-64648)

A server-side `fetch` with a request body may return a cached response body from a different request to the same URL but different body. This only applies for `fetch` calls of the following shape:

```typescript
fetch(new Request(init), aDifferentInit)
```

### Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences (Medium Severity)

[**CVE-2026-64647**](https://www.cve.org/CVERecord?id=CVE-2026-64647)

A server-side `fetch` with a request body may return a cached response body from a different request to the same URL but different body. This only applies when receiving request bodies which contain invalid UTF-8 characters. For example, the UTF-16 byte sequences for `삃삃` and `섄섄` in the request body would share the same cache.

## Our security program

We work with a talented set of researchers to secure Next.js and other open source frameworks through [Vercel's Open Source Bug Bounty](https://hackerone.com/vercel-open-source). Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.

Any questions or concerns regarding our security programs or vulnerability management can be sent to [security@vercel.com](mailto:security@vercel.com).