CVE-2026-27977
Next.js is a React framework for building full-stack web applications.
Published Mar 18, 2026 · updated Jun 17, 2026 · vercel next.js
Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in , cross-site protection for internal websocket endpoints could treat as a bypass case even if is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured still allow connections from any origin. The issue is fixed in version 16.1.7 by validating through the same cross-site origin-allowance checks used for other origins. If upgrading is not immediately possible, do not expose to untrusted networks and/or block websocket upgrades to when is at the proxy.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 18, 2026 · NIST NVD
Detected
Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in , cross-site protection for internal websocket endpoints could treat as a bypass case even if is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled conte
Jun 17, 2026 · NIST NVD
Updated
Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in , cross-site protection for internal websocket endpoints could treat as a bypass case even if is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled conte
Affected
- cpe vercel/next.jsversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-27977
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-27977
Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in , cross-site protection for internal websocket endpoints could treat as a bypass case even if is configur
nvd.nist.gov