Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-27T17:48:17 next: Next.js: Information disclosure via Server Action ID exposure 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-201

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11.

A flaw was found in Next.js. Unauthenticated users can exploit this vulnerability by accessing publicly served client artifacts, which may disclose Server Action IDs. This bypasses authentication on pages where these endpoints are used, leading to information disclosure. While primarily an enumeration primitive, this disclosure can increase overall risk when combined with other vulnerabilities.

This Moderate information disclosure vulnerability in Next.js applications allows unauthenticated users to obtain Server Action IDs from publicly served client artifacts. While primarily a reconnaissance primitive, this exposure could increase overall risk when chained with other weaknesses. Red Hat products and services that incorporate Next.js, such as Red Hat AMQ, Red Hat Enterprise Linux AI, and cloud.redhat.com offerings, are affected. Red Hat Enterprise Linux 10 Fix deferred firefox Red Hat Enterprise Linux 10 Fix deferred thunderbird Red Hat Enterprise Linux 7 Fix deferred firefox Red Hat Enterprise Linux 8 Fix deferred firefox Red Hat Enterprise Linux 8 Fix deferred thunderbird Red Hat Enterprise Linux 9 Fix deferred firefox Red Hat Enterprise Linux 9 Fix deferred thunderbird Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/disk-image-cuda-rhel9 Red Hat Trusted Artifact Signer Fix deferred rhtas/rekor-search-ui-rhel9 streams for Apache Kafka 2 Out of support scope next streams for Apache Kafka 3 Fix deferred next https://www.cve.org/CVERecord?id=CVE-2026-64643 https://nvd.nist.gov/vuln/detail/CVE-2026-64643 https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3 https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b https://github.com/vercel/next.js/releases/tag/v15.5.21 https://github.com/vercel/next.js/releases/tag/v16.2.11 https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp