This vulnerability (CVE-2026-64649) in Next.js Server Actions allows attackers to perform Server-Side Request Forgery (SSRF) by controlling Host-associated headers in requests forwarded or redirected by the server. The flaw arises when the application does not fix the incoming Host header to a trusted value, which is common in custom server configurations or deployments lacking a proxy that pins the host. Managed hosting environments and Next.js versions 14.2.0 and later running with 'next start' or standalone output are not affected due to host pinning. The vulnerability can also lead to exposure of internal values that weaken middleware or proxy authorization in some configurations. The affected versions are >=14.1.1 <15.5.21 and >=16.0.0 <16.2.11. No official patch link is provided, but upgrading to versions 14.2.0 or later with proper host pinning or applying the recommended environment variable mitigations is advised.

An attacker who can control Host-related headers in requests to a vulnerable Next.js server can induce the server to send outbound requests to attacker-controlled or malicious hosts, resulting in Server-Side Request Forgery (SSRF). This can potentially expose internal network resources or bypass middleware/proxy authorization mechanisms in some configurations. The impact is high due to the ability to manipulate server-side requests and potentially access sensitive internal information or systems.

Upgrade to Next.js version 14.2.0 or later, which includes host pinning when using 'next start' or standalone output. If upgrading is not immediately possible, ensure that clients cannot control the Host header by pinning or validating the 'Host' and 'X-Forwarded-Host' headers at the edge or proxy level. Additionally, for versions 14.2.0 and later, set the '__NEXT_PRIVATE_ORIGIN' environment variable to the deployment's real origin URL to enforce origin validation. These mitigations reduce the risk of SSRF by controlling the host headers and origin validation.