This vulnerability, tracked as CVE-2026-27978, affects the Next.js React framework versions from 16.0.1 up to but not including 16.1.7. Next.js introduced Server Actions to facilitate server-side operations triggered by client requests. During CSRF validation of these Server Actions, the framework incorrectly treated requests with an 'origin' header value of 'null' as if the origin was missing, rather than recognizing 'null' as a distinct origin. 'Origin: null' typically appears in requests originating from opaque contexts such as sandboxed iframes or certain cross-origin scenarios. Because of this misclassification, requests from these opaque contexts bypassed the origin verification step, allowing attackers to craft malicious web pages that induce victim browsers to submit Server Actions from sandboxed iframes. This results in CSRF attacks where state-changing operations can be executed with the victim's credentials without their consent. The vulnerability does not require authentication but does require user interaction (e.g., visiting a malicious page). The fix introduced in Next.js 16.1.7 explicitly treats 'null' as an origin value and enforces host and origin checks unless 'null' is explicitly allowlisted in the experimental serverActions.allowedOrigins configuration. This patch closes the bypass vector. If immediate upgrading is not feasible, developers are advised to implement CSRF tokens on sensitive Server Actions, use SameSite=Strict on authentication cookies to limit cross-site cookie transmission, and avoid allowing 'null' origins unless additional protections are in place. The CVSS 4.0 score of 5.3 reflects a medium severity due to network attack vector, no privileges required, no user authentication needed, but requiring user interaction and causing limited integrity impact without affecting confidentiality or availability.

The primary impact of this vulnerability is the potential for unauthorized execution of state-changing Server Actions within Next.js applications, leading to integrity violations. Attackers can exploit this flaw to perform actions on behalf of authenticated users without their consent, such as modifying user data, changing application settings, or triggering transactions. While confidentiality and availability are not directly affected, the integrity compromise can lead to downstream effects including data corruption, unauthorized operations, or privilege escalation within the application context. Organizations relying on Next.js for critical web applications may face reputational damage, regulatory compliance issues, and operational disruptions if exploited. The vulnerability is exploitable remotely over the network without authentication but requires user interaction, which may limit large-scale automated exploitation. However, targeted attacks against high-value users or applications remain a significant risk. The lack of known exploits in the wild currently reduces immediate threat but does not eliminate future exploitation potential, especially as awareness grows.

The most effective mitigation is to upgrade all affected Next.js instances to version 16.1.7 or later, where the vulnerability is fully patched. For environments where immediate upgrading is not possible, developers should implement CSRF tokens on all sensitive Server Actions to ensure requests are validated beyond origin headers. Additionally, setting authentication cookies with the SameSite=Strict attribute reduces the risk of cross-site cookie transmission, limiting CSRF attack vectors. It is critical to avoid allowing 'null' origins in the experimental.serverActions.allowedOrigins configuration unless absolutely necessary and only with additional protective controls such as strict CSRF tokens or custom origin validation. Developers should also audit their applications for any Server Actions that perform state-changing operations and ensure they are properly protected. Monitoring web traffic for unusual requests originating from opaque contexts or sandboxed iframes can help detect exploitation attempts. Finally, educating users about the risks of interacting with untrusted sites can reduce the likelihood of successful user interaction-based attacks.