Security vulnerabilities and automated fixes for nextjs issues
3 posts found
A critical authentication bypass vulnerability (CVE-2026-64642) was discovered in Next.js versions prior to 16.2.11, specifically affecting App Router applications using Turbopack with a single locale configuration. This vulnerability allowed attackers to bypass middleware and proxy protections, potentially gaining unauthorized access to protected routes and resources that should have been secured by authentication checks.
Three public API endpoints in a Next.js application — `/api/send-review`, `/api/contact`, and `/api/auth` — were deployed without any server-side rate limiting, allowing attackers to flood them with unlimited requests. The `/api/send-review` and `/api/contact` endpoints were especially dangerous because every request triggered an outbound email via Gmail SMTP, making them prime targets for email bombing and quota exhaustion. The fix introduces a lightweight in-memory rate limiter capping each IP
A critical pre-authentication remote code execution vulnerability (CVE-2025-55182) was discovered in Next.js React Server Components, allowing attackers to execute arbitrary code on servers without any login or credentials required. The flaw stems from unsafe deserialization of untrusted data passed through the RSC pipeline. The vulnerability has been patched across multiple Next.js release lines, and all affected projects should upgrade immediately.