Threats Tagged 'cve-2026-64649'
View all threats tagged with 'cve-2026-64649'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-64649'
Click on any threat for detailed analysis and mitigation recommendations
Next.js: Server-Side Request Forgery in Server Actions on custom servers (CVE-2026-64649)CVE-2026-64649 0 Next.js versions 14.1.1 up to but not including 15.5.21, and 16.0.0 up to but not including 16.2.11, are affected by a Server-Side Request Forgery (SSRF) vulnerability in Server Actions on custom server setups. This vulnerability allows an attacker to manipulate Host-related headers to cause the server to send outbound requests to malicious hosts. The issue primarily affects deployments where the incoming Host header is not pinned or validated, such as custom servers or deployments not behind a proxy that enforces host validation. Managed hosting and standard Next.js start commands from version 14.2 onward mitigate this risk by pinning the host. Workarounds include validating or pinning Host and X-Forwarded-Host headers at the edge or proxy and setting the __NEXT_PRIVATE_ORIGIN environment variable to the real origin in version 14.2.0 and later. Join the discussion | GCVE Database | 07/22/2026, 23:09:48 UTC Added: 07/23/2026, 01:18:05 UTC |
Showing 1 to 1 of 1 result